---

If you’re running a WordPress website, you likely know about the dangerous consequences of plugin vulnerabilities. One big issue found this year is CVE-2023-1405, affecting the popular Formidable Forms plugin. This bug, discovered around March 2023, puts millions of WordPress websites at risk.

In this article, I’ll break down CVE-2023-1405, show simple code snippets, and explain how attackers exploit it. I’ll also share references so you can read the original technical write-ups.

What is CVE-2023-1405?

CVE-2023-1405 is a PHP Object Injection vulnerability in Formidable Forms before version 6.2.

- Vulnerable Plugin: Formidable Forms

What Went Wrong?

Formidable Forms uses PHP’s unserialize() function on user-supplied input, but does NOT properly sanitize that input first. When an attacker submits a specially-crafted payload, PHP unserializes it and can be tricked into running arbitrary code—if the site has a suitable “gadget” class installed.

In simple terms: If a hacker sends malicious data, Formidable Forms will trust it and try to process it as valid code!

Technical Details

Inside Formidable Forms, at different points (exact function can change across versions), user input can be unserialized like this:

$data = $_POST['formidable_data']; // Supposedly trusted input
$object = unserialize($data); // UNSAFE!

The key problem is that unserialize() will turn attacker-supplied content into real PHP objects—a huge risk if dangerous classes exist anywhere in your WordPress install.

For example, an attacker can send a POST request like this (in pseudo-code)

POST /wp-admin/admin-ajax.php
action=frm_fields_ajax
formidable_data=O:8:"SomeClass":1:{s:4:"prop";s:6:"foobar";}

- The payload is an object (O:8:"SomeClass":1:{...}) that could trigger “magic methods” (like __destruct, __wakeup, or __toString) in a vulnerable plugin or theme.
- If any gadget class with a dangerous method is present, PHP will execute it “magically” when the object is destroyed or interpreted—giving attackers arbitrary code execution.

Formidable Forms before 6.2

- A suitable PHP class (“gadget”) present, e.g. a class with a __destruct() that runs a system command

Example Exploit

Here’s what an attack POST request might look like, exploiting admin-ajax.php (obtained from security blogs):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: victim.com
Content-Type: application/x-www-form-urlencoded

action=frm_fields_ajax&formidable_data=O:8:"SomeClass":1:{s:4:"prop";s:41:"<?php system($_GET['cmd']); ?>";}

*This is a basic illustration. Real attacks use gadgets from other plugins, such as Monolog, for code execution.*

Real-World Example: Using a POP Chain Gadget

Suppose your server has a vulnerable plugin with a class named FileDeleter that deletes files in its destructor. You could send a serialized object to make it delete any file on the server when the object is destroyed.

class FileDeleter {
    public $filename;
    function __destruct() {
        unlink($this->filename);
    }
}

Sending this payload

O:11:"FileDeleter":1:{s:8:"filename";s:12:"/etc/passwd";}

Result: When unserialized, this triggers the class's destructor and deletes /etc/passwd. If a class allows shell execution, the risk is much higher.

Attacker prepares payload: Finds or builds a gadget chain from an existing class.

2. Sends malicious POST request to a Formidable Forms endpoint like /wp-admin/admin-ajax.php.

Attacker gets control or damages server.

*This is why PHP object injection is so dangerous—hijacking the app’s logic, even if you never meant to.*

Protection & Patch

- Upgrade immediately: Formidable Forms 6.2 fixes this bug. Go to your WP admin and update the plugin.
- Don’t allow unserialize on untrusted input! Use json_decode() instead, or strictly validate input before unserializing.
- Check for unused themes/plugins: Attackers need gadgets, so minimize installed plugins and themes.

References to the original bug

- CVE-2023-1405 at MITRE
- Wordfence Advisory
- Patchstack report
- Original plugin changelog

Summary

CVE-2023-1405 is a critical PHP Object Injection in WordPress Formidable Forms < 6.2, triggered by blindly trusting user input and unserializing it. It’s extremely dangerous if a suitable gadget class exists and lets remote, unauthenticated attackers execute arbitrary code.

Timeline

Published on: 01/16/2024 16:15:10 UTC
Last modified on: 01/23/2024 14:28:58 UTC