CVE-2024-0660 Overview
CVE-2024-0660 is a Cross-Site Request Forgery (CSRF) vulnerability in the Formidable Forms plugin for WordPress. The flaw affects all versions up to and including 6.7.2. The root issue is missing or incorrect nonce validation on the update_settings function in FrmFormsController.php. An unauthenticated attacker can forge a request that modifies form settings and injects malicious JavaScript when a site administrator is tricked into clicking a crafted link. The vulnerability maps to CWE-352: Cross-Site Request Forgery.
Critical Impact
Successful exploitation allows attackers to alter plugin form settings and plant stored JavaScript, enabling client-side attacks against administrators and site visitors.
Affected Products
- Strategy11 Formidable Forms plugin for WordPress, versions ≤ 6.7.2
- WordPress sites using Formidable Forms — Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Fixed in Formidable Forms version 6.8
Discovery Timeline
- 2024-02-05 - CVE-2024-0660 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0660
Vulnerability Analysis
The Formidable Forms plugin exposes an update_settings action used to modify form configuration. The handler in FrmFormsController.php does not properly validate a WordPress nonce before applying changes. Without nonce validation, the server cannot confirm the request originated from an authenticated session initiated by the administrator.
An attacker can host a page that submits a crafted request to the vulnerable endpoint. When a logged-in administrator visits that page, the browser attaches the administrator's session cookies, and the plugin processes the request as legitimate. The attacker can modify form settings and insert JavaScript that executes in the browser of anyone loading the affected form.
Root Cause
The root cause is missing or incorrect CSRF nonce verification on the update_settings function. WordPress plugins are expected to validate nonces using check_admin_referer() or wp_verify_nonce() before executing state-changing operations. The vendor fix in changeset 3026901 for the 6.8 tag added the required validation inside FrmFormsController.php.
Attack Vector
Exploitation is network-based and requires user interaction from a privileged administrator. The attacker typically delivers the forged request through a phishing email, malicious ad, forum post, or compromised third-party site. Authentication is not required for the attacker, only for the victim. Once the forged settings update succeeds, injected JavaScript can harvest credentials, pivot to session theft, or deliver malware to site visitors.
Technical details are documented in the Wordfence Vulnerability Report and the WordPress plugin changeset.
Detection Methods for CVE-2024-0660
Indicators of Compromise
- Unexpected modifications to Formidable Forms settings, especially inline <script> tags or event handler attributes embedded in form fields or confirmation messages.
- POST requests to WordPress admin endpoints invoking the update_settings action with HTTP Referer headers pointing to external domains.
- Administrator browser sessions loading external pages immediately before unexplained form configuration changes.
Detection Strategies
- Audit the wp_options and Formidable Forms configuration tables for JavaScript payloads introduced after January 2024.
- Review WordPress audit logs for update_settings activity performed outside of normal administrator workflows.
- Inspect web application firewall logs for cross-origin POST requests to admin-ajax.php or admin-post.php targeting Formidable actions.
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture administrator actions and settings changes with user, source IP, and referer context.
- Monitor outbound requests from end-user browsers to unknown domains after visiting pages that render Formidable Forms.
- Alert on new or modified JavaScript strings appearing in form field definitions, success messages, or redirect URLs.
How to Mitigate CVE-2024-0660
Immediate Actions Required
- Upgrade Formidable Forms to version 6.8 or later on every WordPress site in the environment.
- Review all existing forms for unauthorized JavaScript injected into fields, confirmation messages, redirect URLs, and email templates.
- Rotate administrator credentials and invalidate active sessions if forged settings changes are suspected.
Patch Information
Strategy11 fixed the vulnerability in Formidable Forms version 6.8 by adding proper nonce validation to the update_settings handler. The fix is captured in WordPress plugin changeset 3026901. Administrators should apply the update through the WordPress plugin dashboard or by replacing plugin files directly.
Workarounds
- Restrict administrator browser sessions to dedicated workstations and avoid browsing untrusted sites while authenticated to WordPress.
- Deploy a web application firewall rule that blocks cross-origin POST requests to Formidable Forms admin endpoints lacking a valid nonce.
- Enforce SameSite=Lax or SameSite=Strict cookies on the WordPress admin session to reduce CSRF exposure until patching is complete.
# Update Formidable Forms via WP-CLI to the patched release
wp plugin update formidable --version=6.8
wp plugin list --name=formidable --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
