CVE-2024-9352: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'createmodule' function. This makes it possible for unauthenticated attackers to create draft forms via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9352?
CVE-2024-9352 has a high severity rating due to its impact on security through Cross-Site Request Forgery.
How do I fix CVE-2024-9352?
To fix CVE-2024-9352, update the Forminator Forms plugin to version 1.36.0 or later.
What versions are affected by CVE-2024-9352?
CVE-2024-9352 affects all versions of Forminator Forms up to and including 1.35.1.
What type of vulnerability is CVE-2024-9352?
CVE-2024-9352 is classified as a Cross-Site Request Forgery (CSRF) vulnerability.
Who is the vendor associated with CVE-2024-9352?
The vendor associated with CVE-2024-9352 is WPMU DEV, which develops the Forminator Forms plugin.