Forminator’s front-end user-login form integrates with WP Defender’s two-factor authentication. In the 2FA verification branch, the provider is resolved from the attacker-controlled auth_method POST parameter via get_provider_by_slug(). In 1.55.1, when that lookup returned a WP_Error (unknown or disabled provider slug), the code fell through without setting $response[‘authentication’] and without returning — execution reached the final if ( empty( $sign_on ) || ! is_wp_error( $sign_on ) ) block and the user was signed on with wp_signon(), skipping the second factor entirely. An attacker who knows a valid username and password can therefore defeat the 2FA requirement by submitting an invalid auth_method value.

The fix adds the missing else branch that sets $response[‘authentication’] = ‘invalid’ and returns early, so a failed provider lookup can no longer fall through to sign-on. Exploitation requires WP Defender active with 2FA enabled for the target account.

This vulnerability affects the following application versions:

  • Forminator Forms 1.15.13
  • Forminator Forms 1.15.14
  • Forminator Forms 1.16.2
  • Forminator Forms 1.17.1
  • Forminator Forms 1.17.2
  • Forminator Forms 1.18.1
  • Forminator Forms 1.18.2
  • Forminator Forms 1.19.0
  • Forminator Forms 1.20.1
  • Forminator Forms 1.21.0
  • Forminator Forms 1.22.1
  • Forminator Forms 1.23.3
  • Forminator Forms 1.24.1
  • Forminator Forms 1.24.4
  • Forminator Forms 1.24.5
  • Forminator Forms 1.24.6
  • Forminator Forms 1.25.0
  • Forminator Forms 1.25.1
  • Forminator Forms 1.25.2
  • Forminator Forms 1.26.0
  • Forminator Forms 1.27.0
  • Forminator Forms 1.28.0
  • Forminator Forms 1.28.1
  • Forminator Forms 1.29.0
  • Forminator Forms 1.29.2
  • Forminator Forms 1.29.3
  • Forminator Forms 1.30.2
  • Forminator Forms 1.31.0
  • Forminator Forms 1.32.0
  • Forminator Forms 1.33.0
  • Forminator Forms 1.34.0
  • Forminator Forms 1.34.1
  • Forminator Forms 1.35.0
  • Forminator Forms 1.35.1
  • Forminator Forms 1.36.0
  • Forminator Forms 1.36.1
  • Forminator Forms 1.36.2
  • Forminator Forms 1.36.3
  • Forminator Forms 1.37.1
  • Forminator Forms 1.38.1
  • Forminator Forms 1.38.2
  • Forminator Forms 1.38.3
  • Forminator Forms 1.39.0
  • Forminator Forms 1.39.1
  • Forminator Forms 1.39.2
  • Forminator Forms 1.39.3
  • Forminator Forms 1.40.0
  • Forminator Forms 1.41.1
  • Forminator Forms 1.41.2
  • Forminator Forms 1.42.0
  • Forminator Forms 1.42.1
  • Forminator Forms 1.42.2
  • Forminator Forms 1.43.0
  • Forminator Forms 1.43.1
  • Forminator Forms 1.44
  • Forminator Forms 1.44.1
  • Forminator Forms 1.44.2
  • Forminator Forms 1.44.3
  • Forminator Forms 1.45
  • Forminator Forms 1.45.1
  • Forminator Forms 1.46.1
  • Forminator Forms 1.46.2
  • Forminator Forms 1.47
  • Forminator Forms 1.48.2
  • Forminator Forms 1.48.3
  • Forminator Forms 1.49.0
  • Forminator Forms 1.49.2
  • Forminator Forms 1.50.1
  • Forminator Forms 1.50.3
  • Forminator Forms 1.51
  • Forminator Forms 1.51.1
  • Forminator Forms 1.52
  • Forminator Forms 1.52.1
  • Forminator Forms 1.52.2
  • Forminator Forms 1.53.0
  • Forminator Forms 1.53.0.1
  • Forminator Forms 1.53.1
  • Forminator Forms 1.53.2
  • Forminator Forms 1.54
  • Forminator Forms 1.54.0
  • Forminator Forms 1.55.0
  • Forminator Forms 1.55.0.1
  • Forminator Forms 1.55.0.2
  • Forminator Forms 1.55.1

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *