Product
The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35.