CVE-2023-2877

CVE-2023-2877 is a critical vulnerability affecting the Formidable Forms WordPress plugin prior to version 6.3.1. It allows authenticated users, even those with subscriber-level privileges, to install and activate arbitrary plugins from the WordPress.org repository, leading to Remote Code Execution. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, enabling full compromise of confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, its high EPSS and FAUCET Risk Score indicate a significant potential for future exploitation.