CyberRota Analysis
AI-GeneratedThe Forminator Forms WordPress plugin prior to version 1.57.2.1 is vulnerable due to a lack of nonce, capability, or ownership checks during the migration of one-time payment fields, which occurs on every admin request for logged-in users. This allows any authenticated user, even those with minimal permissions like Subscribers, to alter the saved configuration of forms, potentially compromising live payment forms. WordPress site administrators should prioritize updating this plugin to mitigate the risk of unauthorized modifications.
Original NVD Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.