PatchTheCVECVE-2017-20194: The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, a
CVE-2017-20194 is a medium-severity flaw (CVSS 5.3) affecting formidable form builder. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 34%) |
| CISA exploited list | No |
| Weakness | CWE-200 |
| Published | 2024-10-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-20194?
formidable form builder: upgrade to newer than 2.05.03. Exact commands for each OS are on this page.
Is CVE-2017-20194 being exploited?
CVE-2017-20194 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-20194 affect?
CVE-2017-20194 affects formidable form builder. Severity is medium (CVSS 5.3). The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of
How urgent is CVE-2017-20194?
Priority 45/100. Public exploit reference; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2017-20192 HIGH 8.3 UPGRADE The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple par