WordPress CVEs

Description

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.

Affected WordPress components

• Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin · forminator
  Confirmed match Active
  Up to and including 1.35.1
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Up to and including 1.35.1
• incsub forminator — Up to and including 1.35.1
• wpmudev forminator_forms — Before 1.36.0

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3169243/ Product
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/be1d9d2b-cbdf-4d62-85fe-2616eaf02848?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record