The submission export used a permission helper that did not actually restrict the caller, letting any authenticated Forminator user download entry exports belonging to forms they should not see. The export now checks the caller is allowed and stops with an explicit error when the check or the nonce fails.
This vulnerability affects the following application versions:
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2
- Forminator Forms 1.29.3
- Forminator Forms 1.30.2
- Forminator Forms 1.31.0
- Forminator Forms 1.32.0
- Forminator Forms 1.33.0
- Forminator Forms 1.34.0
- Forminator Forms 1.34.1
- Forminator Forms 1.35.0
- Forminator Forms 1.35.1
- Forminator Forms 1.36.0
- Forminator Forms 1.36.1
- Forminator Forms 1.36.2
- Forminator Forms 1.36.3
- Forminator Forms 1.37.1
- Forminator Forms 1.38.1
- Forminator Forms 1.38.2
- Forminator Forms 1.38.3
- Forminator Forms 1.39.0
- Forminator Forms 1.39.1
- Forminator Forms 1.39.2
- Forminator Forms 1.39.3
- Forminator Forms 1.40.0
- Forminator Forms 1.41.1
- Forminator Forms 1.41.2
- Forminator Forms 1.42.0
- Forminator Forms 1.42.1
- Forminator Forms 1.42.2
- Forminator Forms 1.43.0
- Forminator Forms 1.43.1
- Forminator Forms 1.44
- Forminator Forms 1.44.1
- Forminator Forms 1.44.2
- Forminator Forms 1.44.3
- Forminator Forms 1.45
- Forminator Forms 1.45.1
- Forminator Forms 1.46.1
- Forminator Forms 1.46.2
- Forminator Forms 1.47
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0