CVE-2025-14782
BaseFortify
Publication date: 2026-01-09
Last updated on: 2026-01-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpforms | forminator | to 1.49.1 (inc) |
| wpforms | forminator | 1.49.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authorization bypass in the Forminator Forms WordPress plugin (versions up to 1.49.1). It occurs because the plugin does not properly verify if a user is authorized to perform the CSV export action via the 'listen_for_csv_export' function. As a result, authenticated users with access to the Forminator dashboard can export sensitive form submission data, including personally identifiable information, without proper permission. [2]
How can this vulnerability impact me? :
The vulnerability allows authenticated users with dashboard access to export sensitive form submission data, which may include personally identifiable information. This unauthorized data export can lead to data exposure and potential privacy breaches, putting sensitive user information at risk. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the Forminator plugin version 1.49.1 or earlier. Additionally, monitoring for unauthorized CSV export requests to the Forminator export endpoint could help detect exploitation attempts. Since the vulnerability involves the 'listen_for_csv_export' function, you might look for HTTP requests that trigger CSV exports without proper authorization. Specific commands are not provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Forminator plugin to version 1.49.2 or later, where the vulnerability is fixed by adding proper permission checks and nonce verification to the export functionality. This update ensures that only authorized users can export form submissions and protects against CSRF attacks. [2]