Forminator Forms WordPress Plugin Authorization Bypass Vulnerability Allowing CSV Export of Sensitive Data

A vulnerability exists in the Forminator Forms WordPress plugin, specifically in versions up to and including 1.49.1. The issue arises from an authorization bypass in the 'listen_for_csv_export' function, where the plugin fails to properly verify user permissions. This flaw enables authenticated users with access to the Forminator dashboard to export sensitive form submission data, including personally identifiable information.

Impact

Exploitation of this vulnerability allows for unauthorized export of form submission data, including personally identifiable information, by authenticated users with access to the Forminator dashboard.

Remediation

Users are advised to update the Forminator Forms plugin to version 1.49.2 or a newer patched version.