CVE-2023-1405

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Unknown	Formidable Forms	< 6.2

References

https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/8c727a31-ff65-4472-8191-b1becc08192a/Exploit, Third Party Advisory

Timeline

Published: Jan 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-14068.8The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a CVE-2023-14077.2A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnera CVE-2023-14087.2The Video List Manager WordPress plugin through 1.7 does not properly sanitise and escape a parameter before using it in a SQL statement, le CVE-2023-14097.5If the MongoDB Server running on Windows or macOS is configured to use TLS with a specific set of configuration options that are already kno CVE-2023-14104.8Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescri CVE-2023-14127.8An unprivileged (non-admin) user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows (<= 2022.12.CVE-2023-14136.1The WP VR WordPress plugin before 8.2.9 does not sanitise and escape some parameters before outputting them back in the page, leading to a R CVE-2023-14144.3The WP VR WordPress plugin before 8.3.0 does not have authorisation and CSRF checks in various AJAX actions, one in particular could allow a CVE-2023-14158.8A vulnerability was found in Simple Art Gallery 1.0. It has been declared as critical. This vulnerability affects the function sliderPicSubm CVE-2023-14169.8A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. CVE-2023-14174.3An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.1 CVE-2023-14186.1A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by thi