Missing Authorization in Forminator Submission CSV Export

Skrevet den af i Forminator Forms

The submission export used a permission helper that did not actually restrict the caller, letting any authenticated Forminator user download entry exports belonging to forms they should not see. The export now checks the caller is allowed and stops with an explicit error when the check or the nonce fails.

This vulnerability affects the following application versions:

  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0

Unauthenticated Nonce Disclosure for Unpublished Forms in Forminator Forms

Skrevet den af i Forminator Forms

Forminator Forms’ public forminator_get_nonce AJAX action handed any unauthenticated visitor a valid submission nonce for any form ID, including draft and other unpublished forms and forms configured to load via AJAX. Because the submission handler does not check the form’s publish status itself, an attacker could use the nonce to submit entries to forms the site owner never published. Affects versions 1.36.0 to 1.58.2; fixed in 1.58.3.

This vulnerability affects the following application versions:

  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2
  • Forminator Forms 1.56.1
  • Forminator Forms 1.56.2
  • Forminator Forms 1.57.0
  • Forminator Forms 1.57.0.1
  • Forminator Forms 1.57.0.2
  • Forminator Forms 1.57.0.3
  • Forminator Forms 1.57.0.4
  • Forminator Forms 1.57.0.5
  • Forminator Forms 1.57.0.6
  • Forminator Forms 1.57.0.7
  • Forminator Forms 1.57.0.8
  • Forminator Forms 1.57.1
  • Forminator Forms 1.57.1.1
  • Forminator Forms 1.57.2
  • Forminator Forms 1.57.2.1
  • Forminator Forms 1.57.3
  • Forminator Forms 1.57.3.1
  • Forminator Forms 1.58.0
  • Forminator Forms 1.58.1
  • Forminator Forms 1.58.2

Contributor Privilege Escalation in Forminator Forms XML-RPC

Skrevet den af i Forminator Forms

Forminator did not check its own form-management permission when WordPress XML-RPC wp.newPost / wp.editPost calls targeted Forminator forms, quizzes or polls, and it accepted submissions to any form that was not a draft. A Contributor could therefore create a pending registration form over XML-RPC that grants the Administrator role, then submit it to obtain an administrator account. The patch blocks those XML-RPC calls for users without Forminator access and only accepts submissions to published forms (and to lead forms linked from a published quiz), as upstream 1.56.0.1 does.

This vulnerability affects the following application versions:

  • Forminator Forms 1.13.3
  • Forminator Forms 1.13.4
  • Forminator Forms 1.13.5
  • Forminator Forms 1.14.6
  • Forminator Forms 1.14.7
  • Forminator Forms 1.14.8
  • Forminator Forms 1.14.8.1
  • Forminator Forms 1.14.9
  • Forminator Forms 1.14.10.1
  • Forminator Forms 1.14.11
  • Forminator Forms 1.14.12
  • Forminator Forms 1.14.12.1
  • Forminator Forms 1.15.0.1
  • Forminator Forms 1.15.2
  • Forminator Forms 1.15.4
  • Forminator Forms 1.15.7
  • Forminator Forms 1.15.9
  • Forminator Forms 1.15.11
  • Forminator Forms 1.15.12
  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0

Missing Authorization in Forminator Forms Hub Connector

Skrevet den af i Forminator Forms

On a WordPress Multisite network, Forminator’s bundled WPMU DEV Hub Connector only checked the single-site manage_options capability before connecting the site to the Hub, handing out its auth nonce, storing the network-wide API key and serving its sync/logout REST endpoints. Any single-site administrator could therefore connect the whole network to a Hub account they control and use it to install plugins and themes network-wide, executing arbitrary code on every site. The patch requires manage_network_options on multisite, as upstream 1.57.0.5 does.

This vulnerability affects the following application versions:

  • Smush 3.22.1
  • Smush 3.22.3
  • Smush 3.23.0
  • Smush 3.23.1
  • Smush 3.23.2
  • Smush 3.23.3
  • Smush 3.23.4
  • Smush 3.24.0
  • Smush 3.24.0-beta.2
  • Smush 4.0.2
  • Smush 4.0.3
  • Smush 4.1.0
  • Smush 4.1.1
  • Smush 4.1.2
  • Smush 4.2.0
  • Smush 4.3.0
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2
  • Forminator Forms 1.56.1
  • Forminator Forms 1.56.2
  • Forminator Forms 1.57.0
  • Forminator Forms 1.57.0.1
  • Forminator Forms 1.57.0.2
  • Forminator Forms 1.57.0.3
  • Forminator Forms 1.57.0.4

Unauthenticated XSS in Forminator Forms Module Preview

Skrevet den af i Forminator Forms

Forminator Forms before 1.56.1 accepted the public module-loading nonce for its preview mode, so an unauthenticated attacker could replay a nonce from any public page with attacker-controlled preview data. The preview data reaches the poll chart’s inline script without JavaScript-safe escaping, letting the attacker run script in visitors’ browsers.

This vulnerability affects the following application versions:

  • Forminator Forms 1.13.3
  • Forminator Forms 1.13.4
  • Forminator Forms 1.13.5
  • Forminator Forms 1.14.6
  • Forminator Forms 1.14.7
  • Forminator Forms 1.14.8
  • Forminator Forms 1.14.8.1
  • Forminator Forms 1.14.9
  • Forminator Forms 1.14.10.1
  • Forminator Forms 1.14.11
  • Forminator Forms 1.14.12
  • Forminator Forms 1.14.12.1
  • Forminator Forms 1.15.0.1
  • Forminator Forms 1.15.2
  • Forminator Forms 1.15.4
  • Forminator Forms 1.15.7
  • Forminator Forms 1.15.9
  • Forminator Forms 1.15.11
  • Forminator Forms 1.15.12
  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2

SQL Injection in Forminator Forms Entry Filters

Skrevet den af i Forminator Forms

Forminator Forms up to 1.29.2 builds the ORDER BY clause of its submission-entry query from the unquoted order_by and order filter values, so an authenticated administrator can append arbitrary SQL through the submissions export. This lets the attacker read or modify database contents beyond their role and cause denial of service.

This vulnerability affects the following application versions:

  • Forminator Forms 1.13.4
  • Forminator Forms 1.14.6
  • Forminator Forms 1.14.7
  • Forminator Forms 1.14.8
  • Forminator Forms 1.14.8.1
  • Forminator Forms 1.14.9
  • Forminator Forms 1.14.10.1
  • Forminator Forms 1.14.11
  • Forminator Forms 1.14.12
  • Forminator Forms 1.14.12.1
  • Forminator Forms 1.15.0.1
  • Forminator Forms 1.15.2
  • Forminator Forms 1.15.4
  • Forminator Forms 1.15.7
  • Forminator Forms 1.15.9
  • Forminator Forms 1.15.11
  • Forminator Forms 1.15.12
  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2

Unauthenticated Arbitrary File Upload in Forminator Forms Upload Field

Skrevet den af i Forminator Forms

Forminator Forms up to 1.56.1 compares pipe-separated MIME type keys (such as ‘php|txt’) against its dangerous-extension blocklist as whole strings, so a key that bundles a blocked extension with an allowed one is never removed from the allowed upload types. The protective .htaccess and index.php in the Forminator uploads directory were also only created when WordPress admin functions happened to be loaded, which is never the case on a frontend form submission. Combined with a forged upload field configuration, an unauthenticated visitor can upload a PHP file and execute it.

This vulnerability affects the following application versions:

  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2
  • Forminator Forms 1.56.1

Unauthenticated PHP Object Injection in Forminator Forms Entry Form UID

Skrevet den af i Forminator Forms

Forminator stored the visitor-supplied form_uid value of abandoned (save-and-continue) submissions unserialized in the entry meta table and later passed it to maybe_unserialize() when loading the entry. An unauthenticated attacker can submit a crafted serialized PHP object as form_uid, leading to PHP Object Injection and, if a suitable POP chain is present, remote code execution.

This vulnerability affects the following application versions:

  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2
  • Forminator Forms 1.56.1
  • Forminator Forms 1.56.2
  • Forminator Forms 1.57.0
  • Forminator Forms 1.57.0.1
  • Forminator Forms 1.57.0.2
  • Forminator Forms 1.57.0.3
  • Forminator Forms 1.57.0.4
  • Forminator Forms 1.57.0.5

Stored Cross-Site Scripting in Forminator Forms Select, Radio and Checkbox Fields

Skrevet den af i Forminator Forms

Unauthenticated attackers can submit forged array values for Select, Radio and Checkbox fields, including a forged upload record, which bypass sanitization and are stored with the form entry. The stored content can execute JavaScript when an administrator views the submission. Sites running Forminator Forms 1.56.1 and earlier are affected.

This vulnerability affects the following application versions:

  • Forminator Forms 1.13.4
  • Forminator Forms 1.14.6
  • Forminator Forms 1.14.7
  • Forminator Forms 1.14.8
  • Forminator Forms 1.14.8.1
  • Forminator Forms 1.14.9
  • Forminator Forms 1.14.10.1
  • Forminator Forms 1.14.11
  • Forminator Forms 1.14.12
  • Forminator Forms 1.14.12.1
  • Forminator Forms 1.15.0.1
  • Forminator Forms 1.15.2
  • Forminator Forms 1.15.4
  • Forminator Forms 1.15.7
  • Forminator Forms 1.15.9
  • Forminator Forms 1.15.11
  • Forminator Forms 1.15.12
  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1
  • Forminator Forms 1.56.0
  • Forminator Forms 1.56.0.1
  • Forminator Forms 1.56.0.2
  • Forminator Forms 1.56.1

Two-factor authentication bypass in Defender 2FA login integration

Skrevet den af i Forminator Forms

Forminator’s front-end user-login form integrates with WP Defender’s two-factor authentication. In the 2FA verification branch, the provider is resolved from the attacker-controlled auth_method POST parameter via get_provider_by_slug(). In 1.55.1, when that lookup returned a WP_Error (unknown or disabled provider slug), the code fell through without setting $response[‘authentication’] and without returning — execution reached the final if ( empty( $sign_on ) || ! is_wp_error( $sign_on ) ) block and the user was signed on with wp_signon(), skipping the second factor entirely. An attacker who knows a valid username and password can therefore defeat the 2FA requirement by submitting an invalid auth_method value.

The fix adds the missing else branch that sets $response[‘authentication’] = ‘invalid’ and returns early, so a failed provider lookup can no longer fall through to sign-on. Exploitation requires WP Defender active with 2FA enabled for the target account.

This vulnerability affects the following application versions:

  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1