Formidable Forms passed every POST value read through FrmAppHelper::get_post_param() to maybe_unserialize(), so an unauthenticated visitor could submit a serialized PHP object in a parameter such as form_id and have it instantiated on any front-end request. With a suitable gadget class present this can lead to code execution or data tampering. Affects versions before 4.02.01 (exploitable from 4.x, where the value is unslashed before deserialization); fixed in 4.02.01.
This vulnerability affects the following application versions:
- Formidable Forms 4.01.02