CVE-2024-0660

CVE-2024-0660 affects the Formidable Forms plugin for WordPress, specifically versions up to and including 6.7.2. This Cross-Site Request Forgery (CSRF) vulnerability stems from inadequate nonce validation in the update_settings function. An unauthenticated attacker could exploit this by tricking a site administrator into clicking a malicious link, allowing them to alter form settings and inject JavaScript. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low integrity impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, suggesting low public awareness.