{"id":"CVE-2017-20194","aliases":["EUVD-2017-18912","GHSA-2xfv-566j-24f6"],"status":"published","title":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Information Disclosure","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01128,"percentile":0.66543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-10-16T07:31:52Z","modified":"2026-06-17T01:15:22Z","exploits":[{"source":"nuclei","id":"CVE-2017-20194","title":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-20194.yaml"}],"products":[{"vendor":"strategy11","product":"formidable_form_builder"},{"vendor":"strategy11","product":"formidable_forms"},{"vendor":"strategy11team","product":"formidable forms – contact form plugin, survey, quiz, payment, calculator form \u0026 custom form builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/c7600fe1-94e4-4e3e-a9a6-ff3589813715?source=cve","tags":["Third Party Advisory"]},{"url":"https://klikki.fi/formidable-forms-vulnerabilities/","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20194"},{"url":"https://klikki.fi/formidable-forms-vulnerabilities"},{"url":"https://github.com/advisories/GHSA-2xfv-566j-24f6"}],"sources":{"cve":[{"id":"CVE-2017-20194","title":"Formidable Form Builder \u003c 2.05.03 - Unauthenticated Information Disclosure","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.","status":"published","published":"2024-10-16T07:31:52.606Z","modified":"2026-04-08T17:21:24.478Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2017-18912","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.","status":"published","published":"2024-10-16T07:31:52Z","modified":"2026-04-08T17:21:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:40.947442Z"}],"ghsa":[{"id":"GHSA-2xfv-566j-24f6","title":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in...","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.","status":"published","published":"2024-10-16T09:30:31Z","modified":"2024-10-16T09:30:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:58:30.925935Z"}],"nvd":[{"id":"CVE-2017-20194","description":"The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.","status":"published","published":"2024-10-16T08:15:03.453Z","modified":"2026-06-17T01:15:22.78Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:21.492973Z"}]}}