The vulnerability allows unauthenticated users to set the form entry "updated_by" field, which the plugin uses to decide whether to strip HTML from stored values. Because the plugin believes the record was edited by an administrator, it skips sanitization, and malicious markup is rendered when an admin views the entry. This flaw effectively grants unauthenticated visitors the ability to inject content that will be displayed from an admin context, resulting in a stored XSS condition that could be used to hijack sessions or display deceptive content. The weakness is a type of input validation flaw that also allows an attacker to impersonate an administrator by forging the "updated_by" field.

WordPress plugin Formidable Forms, any release prior to 6.35. Users running version 6.34 or earlier are affected unless the plugin has been patched or the plugin’s form entry submission feature has been disabled for anonymous visitors.

The CVSS score is not provided in the available data, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is a web-based form submission that is accessible to anyone, so the flaw can be triggered without authentication. Once exploited, an attacker can insert arbitrary markup into the admin view and can masquerade as an administrator. However, the exploit does not provide remote code execution or broader system compromise beyond the WordPress admin interface. The low EPSS suggests limited real-world exploitation, but the impact to compromised administrative accounts or user trust can be significant if not mitigated.