Forminator’s front-end user-login form integrates with WP Defender’s two-factor authentication. In the 2FA verification branch, the provider is resolved from the attacker-controlled auth_method POST parameter via get_provider_by_slug(). In 1.55.1, when that lookup returned a WP_Error (unknown or disabled provider slug), the code fell through without setting $response[‘authentication’] and without returning — execution reached the final if ( empty( $sign_on ) || ! is_wp_error( $sign_on ) ) block and the user was signed on with wp_signon(), skipping the second factor entirely. An attacker who knows a valid username and password can therefore defeat the 2FA requirement by submitting an invalid auth_method value.
The fix adds the missing else branch that sets $response[‘authentication’] = ‘invalid’ and returns early, so a failed provider lookup can no longer fall through to sign-on. Exploitation requires WP Defender active with 2FA enabled for the target account.
This vulnerability affects the following application versions:
- Forminator Forms 1.15.13
- Forminator Forms 1.15.14
- Forminator Forms 1.16.2
- Forminator Forms 1.17.1
- Forminator Forms 1.17.2
- Forminator Forms 1.18.1
- Forminator Forms 1.18.2
- Forminator Forms 1.19.0
- Forminator Forms 1.20.1
- Forminator Forms 1.21.0
- Forminator Forms 1.22.1
- Forminator Forms 1.23.3
- Forminator Forms 1.24.1
- Forminator Forms 1.24.4
- Forminator Forms 1.24.5
- Forminator Forms 1.24.6
- Forminator Forms 1.25.0
- Forminator Forms 1.25.1
- Forminator Forms 1.25.2
- Forminator Forms 1.26.0
- Forminator Forms 1.27.0
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2
- Forminator Forms 1.29.3
- Forminator Forms 1.30.2
- Forminator Forms 1.31.0
- Forminator Forms 1.32.0
- Forminator Forms 1.33.0
- Forminator Forms 1.34.0
- Forminator Forms 1.34.1
- Forminator Forms 1.35.0
- Forminator Forms 1.35.1
- Forminator Forms 1.36.0
- Forminator Forms 1.36.1
- Forminator Forms 1.36.2
- Forminator Forms 1.36.3
- Forminator Forms 1.37.1
- Forminator Forms 1.38.1
- Forminator Forms 1.38.2
- Forminator Forms 1.38.3
- Forminator Forms 1.39.0
- Forminator Forms 1.39.1
- Forminator Forms 1.39.2
- Forminator Forms 1.39.3
- Forminator Forms 1.40.0
- Forminator Forms 1.41.1
- Forminator Forms 1.41.2
- Forminator Forms 1.42.0
- Forminator Forms 1.42.1
- Forminator Forms 1.42.2
- Forminator Forms 1.43.0
- Forminator Forms 1.43.1
- Forminator Forms 1.44
- Forminator Forms 1.44.1
- Forminator Forms 1.44.2
- Forminator Forms 1.44.3
- Forminator Forms 1.45
- Forminator Forms 1.45.1
- Forminator Forms 1.46.1
- Forminator Forms 1.46.2
- Forminator Forms 1.47
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0
- Forminator Forms 1.49.2
- Forminator Forms 1.50.1
- Forminator Forms 1.50.3
- Forminator Forms 1.51
- Forminator Forms 1.51.1
- Forminator Forms 1.52
- Forminator Forms 1.52.1
- Forminator Forms 1.52.2
- Forminator Forms 1.53.0
- Forminator Forms 1.53.0.1
- Forminator Forms 1.53.1
- Forminator Forms 1.53.2
- Forminator Forms 1.54
- Forminator Forms 1.54.0
- Forminator Forms 1.55.0
- Forminator Forms 1.55.0.1
- Forminator Forms 1.55.0.2
- Forminator Forms 1.55.1