Forminator Registration Form Role Escalation via Quiz Import

Executive Summary

This vulnerability affects the Forminator Forms WordPress plugin before version 1.57.2.1. It allows authenticated users with quiz import privileges to escalate their privileges by importing a quiz containing a nested registration form. The form can be set to grant any user role, including administrator, when submitted. The plugin fails to enforce role validation during the import process, unlike standard form creation.

Useful 0 Not Useful 0

Detection Guidance

Check if your Forminator Forms plugin version is below 1.57.2.1. Use WordPress admin to inspect installed plugins or run: wp plugin list --name=forminator --fields=name,version

Useful 0 Not Useful 0

Impact Analysis

An attacker with quiz import privileges could exploit this to grant themselves or others administrator access to the WordPress site. This could lead to full control over the site, including data theft, defacement, or further compromise of the server. Users cannot create or import the same form through normal methods, but the imported quiz bypasses these restrictions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Unauthorized administrator access may result in non-compliance with these regulations, potentially leading to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Forminator Forms to version 1.57.2.1 or later immediately. Revoke any suspicious administrator roles created through the vulnerability. Disable quiz import functionality if not required.

Useful 0 Not Useful 0