CVE-2024-10402
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.
- Score
- CVSS 3.1 8.8 High
- Status
- Analyzed - security@wordfence.com
- Published
- 2024-10-26
- Last modified
- 2026-04-08
- Weaknesses
- CWE-862
Affected products
- Forminator (Incsub)
- Forminator Forms (Wpmudev)
- Forminator Forms Contact Form (Wpmudev)
- Payment Form Custom Form Builder (Wpmudev)
References
- https://plugins.trac.wordpress.org/changeset/3169243/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/be1d9d2b-cbdf-4d62-85fe-2616eaf02848?source=cve
