CVE-2026-11361

The Formidable Forms plugin for WordPress in versions up to and including 6.35 is vulnerable to Arbitrary Plugin Installation via the 'file_url' parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback relying solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins. Authenticated attackers with subscriber-level access and above can install arbitrary plugins, provided the site is free-only (Formidable Pro is not installed).

The Formidable Forms WordPress plugin before version 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML. This allows unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values. This allows unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.

The Formidable Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. By forging frm_user_id to match an administrator's user ID, the attacker causes wp_kses_post() to be the only filter, and the script executes automatically.