The Formidable Forms plugin (WordPress) is susceptible to arbitrary plugin installation because the 'file_url' parameter bypasses URL prefix validation and a shared token is used without checking install or activate capabilities. An attacker who is logged in with a subscriber or higher role can supply a plugin URL and install it, potentially executing code on the server and compromising confidentiality, integrity, and availability.

Affected product: Formidable Forms from strategy11team, any WordPress installation using the plugin up to and including version 6.35. The vulnerability is only exploitable on free-only sites that do not have Formidable Pro installed, since the plugin’s capability checks differ in the paid version.

The CVSS score of 8.8 indicates a high severity vulnerability, and while EPSS data is not provided, the lack of a KEV listing suggests no publicly known exploits yet. Attackers need a valid subscriber or higher credential, and the site must not have Formidable Pro, limiting the pool of potential victims. Nevertheless, once accessed, arbitrary plugin installation can lead to full control over the site.