Volerion logoVolerion
Volerion logoVolerion

FormCraft WordPress Plugin Missing Authorization Vulnerability in Data Export

Vulnerability

A vulnerability exists in the FormCraft WordPress plugin, all versions through 3.9.11, due to a missing capability check in formcraft-main.php. This flaw allows authenticated attackers with Subscriber-level access and above to export all plugin data, potentially including sensitive information from form submissions.

Impact

Exploitation of this vulnerability could lead to unauthorized access and export of sensitive form submission data from the WordPress site.

Remediation

Users are advised to update the FormCraft WordPress plugin to version 3.9.12 or a newer patched version.

Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM

Vulnerability Rating

Custom Algorithm
spread
3.4
impact
2.5
exploitability
5.4
remediation
7.7
relevance
0.0
threat
0.0
urgency
2.9
incentive
1.7

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.