Forminator Forms EUVD-2026-28235

The attacker must be an authenticated WordPress user with at least subscriber-level access and access to any Forminator admin page that localizes the forminatorData object (including Templates, Reports, or other pages accessible to non-module-managers). The vulnerable processRequest() method is invoked during the admin_menu hook before WordPress enforces standard capability checks, enabling the attack before page-level permissions are enforced. The nonce must be valid and present in the global JavaScript object; because it is unconditionally localized on all Forminator admin pages, any authenticated user who can access any such page can extract it. The victim form/poll/quiz must be published. No special Forminator configuration is required - the vulnerability exists in the default code path for all users lacking the manage_forminator_modules capability. Exploitation is blocked if the site's WordPress configuration prevents authenticated users from accessing any Forminator admin page, or if the site disables JavaScript object localization through custom filters.

CVSS 5.3 with network vector (AV:N), high complexity (AC:H), and low privileges required (PR:L) indicates moderate real-world risk with authentication and some operational constraints. The authentication requirement (PR:L) limits the attack surface to authenticated users; however, the vulnerability still enables credential exfiltration and data destruction by users who should not have module-management access, making it a privilege-escalation vulnerability within WordPress. The AC:H suggests some exploitation friction, likely due to the requirement to craft valid requests with the nonce and target the correct action parameters. KEV status and active exploitation are not confirmed in the provided data, but the vulnerability is publicly disclosed with full technical details and proof-of-concept references. The real-world risk is elevated for multi-user WordPress installations with mixed privilege tiers where subscriber-level accounts or restricted Forminator roles are in use; single-admin sites face lower risk. No EPSS score provided, limiting cross-vendor exploitation probability comparison. The missing authorization check is a classic high-impact issue because it affects all instances where the vulnerable actions are invoked - not conditional on feature flags or non-default configurations.

An authenticated subscriber-level user with access to the Forminator Templates or Reports page (which are accessible to non-admin users) extracts the forminator_form_request nonce from the localized forminatorData JavaScript object visible in the page source. The attacker crafts a POST request to admin-ajax.php with the nonce and a request action such as 'export' or 'delete', targeting the ID of a published form owned by another user or administrator. Because the vulnerable processRequest() method fires during admin_menu and only validates the nonce without checking capabilities, the request succeeds, allowing the attacker to export the form configuration (including SMTP credentials or third-party integration keys) or delete the form and all associated submissions.