Unauthenticated Arbitrary Content Deletion in Forminator

Executive Summary

This vulnerability allows unauthenticated attackers to delete posts, pages, or records in WordPress Forminator versions 1.57.3 and below without permission. It is classified as high priority with a CVSS score of 7.5.

Useful 0 Not Useful 0

Detection Guidance

Check if Forminator plugin version is 1.57.3 or below. Look for unusual deletion activity in WordPress logs or database. Monitor for unauthorized POST requests to /wp-admin/admin-ajax.php with action=forminator_delete_record.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to delete critical website content, leading to data loss, website downtime, or reputational damage. Mass-exploitation campaigns could target thousands of websites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized deletion of sensitive data, which may violate GDPR's data integrity and availability requirements under Article 5 and HIPAA's integrity and availability standards for protected health information. Unauthorized deletion of records could result in non-compliance with data retention policies.

Useful 0 Not Useful 0

Mitigation Strategies

Update Forminator plugin to version 1.58.0 or later immediately. Apply Patchstack's mitigation rule if unable to update. Review and restrict user permissions. Monitor for signs of exploitation.

Useful 0 Not Useful 0