CyberRota Analysis
AI-GeneratedThe Forminator Forms WordPress plugin prior to version 1.57.2.1 is vulnerable to unauthorized message sending, allowing unauthenticated users to exploit the notification system to send emails with arbitrary links using the site's mail configuration. This could lead to phishing attacks or other malicious activities, as attackers can leverage the site's reputation to deliver harmful content. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.