Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-10402: Unauthorized access to WordPress plugin's forms possible with Contributor-level access

CVE-2024-10402 · published 2 years ago

Summary

The Forminator Forms plugin for WordPress is vulnerable to unauthorized access. An attacker with sufficient permissions can create or edit forms, including changing the default user role on registration forms. Update to the latest version of the plugin to fix this vulnerability.

What to do

Update wpmudev forminator_forms to version 1.36.0 or later.

Affected software

Vendor	Product	Affected versions
wpmudev	forminator_forms	< 1.36.0 `cpe:2.3:a:wpmudev:forminator_forms:::::free:wordpress::`

Original advisory text

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to create new or edit existing forms, including updating the default registration role to Administrator on User Registration forms.

References

https://plugins.trac.wordpress.org/changeset/3169243/ Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/be1d9d2b-cbdf-4d62-85f... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published26 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-10402 · NVD

Track software like this

Free during beta