Forminator stored the visitor-supplied form_uid value of abandoned (save-and-continue) submissions unserialized in the entry meta table and later passed it to maybe_unserialize() when loading the entry. An unauthenticated attacker can submit a crafted serialized PHP object as form_uid, leading to PHP Object Injection and, if a suitable POP chain is present, remote code execution.
This vulnerability affects the following application versions:
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0
- Forminator Forms 1.49.2
- Forminator Forms 1.50.1
- Forminator Forms 1.50.3
- Forminator Forms 1.51
- Forminator Forms 1.51.1
- Forminator Forms 1.52
- Forminator Forms 1.52.1
- Forminator Forms 1.52.2
- Forminator Forms 1.53.0
- Forminator Forms 1.53.0.1
- Forminator Forms 1.53.1
- Forminator Forms 1.53.2
- Forminator Forms 1.54
- Forminator Forms 1.54.0
- Forminator Forms 1.55.0
- Forminator Forms 1.55.0.1
- Forminator Forms 1.55.0.2
- Forminator Forms 1.55.1
- Forminator Forms 1.56.0
- Forminator Forms 1.56.0.1
- Forminator Forms 1.56.0.2
- Forminator Forms 1.56.1
- Forminator Forms 1.56.2
- Forminator Forms 1.57.0
- Forminator Forms 1.57.0.1
- Forminator Forms 1.57.0.2
- Forminator Forms 1.57.0.3
- Forminator Forms 1.57.0.4
- Forminator Forms 1.57.0.5