The formidable plugin prior to 4.02.01 for WordPress has unsafe deserialization.
strategy11 formidable form builder