CyberRota Analysis
AI-GeneratedThe Forminator Forms WordPress plugin prior to version 1.57.2.1 is vulnerable due to improper deserialization of XML-RPC requests, enabling users with forms-management permissions to instantiate arbitrary classes. This flaw allows for file writing and execution of arbitrary code, posing a significant risk to sites where non-administrative roles are granted these permissions. WordPress administrators and security teams managing sites with this plugin should prioritize patching to mitigate potential exploitation.
Original NVD Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.