Compliance Impact

This vulnerability allows authenticated attackers with subscriber-level access to configure scheduled export jobs that email all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.

Such unauthorized disclosure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information to prevent unauthorized access and data breaches.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to sensitive data exfiltration by unauthorized users. Attackers with low-level access can configure the plugin to email all form submissions to themselves.

As a result, confidential or personal information collected via forms can be leaked, potentially causing privacy breaches and data loss.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in the Forminator Forms plugin for WordPress, specifically in versions up to and including 1.53.0. It is caused by the listen_for_saving_export_schedule() function failing to check user permissions before saving scheduled export configurations.

Because of this missing authorization check, authenticated users with only subscriber-level access can configure scheduled export jobs that send all form submissions to an attacker-controlled email address.

This flaw allows attackers to exfiltrate sensitive data submitted through forms without proper authorization.

Useful 0 Not Useful 0