CVE-2024-10402
📋 TL;DR
The Forminator WordPress plugin has an authorization bypass vulnerability that allows authenticated users with Contributor-level access or higher to create/edit forms and modify user registration forms to set default roles to Administrator. This affects all WordPress sites using Forminator versions up to 1.35.1.
💻 Affected Systems
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers with minimal permissions can create administrator accounts, leading to complete site compromise, data theft, malware injection, and privilege escalation.
Likely Case
Malicious contributors or authors modify registration forms to create backdoor admin accounts, gaining full control over the WordPress installation.
If Mitigated
With strict user role management and monitoring, impact is limited to unauthorized form modifications by trusted users.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.35.2
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3169243/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Forminator plugin. 4. Click 'Update Now' if update is available. 5. Alternatively, download version 1.35.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporarily disable plugin
allDeactivate Forminator plugin until patched
wp plugin deactivate forminator
Restrict user roles
allRemove Contributor and Author roles from untrusted users
wp user list --role=contributor --field=ID
wp user set-role <user_id> subscriber
🧯 If You Can't Patch
- Implement strict user role management - only grant Contributor+ roles to absolutely trusted users
- Enable comprehensive logging and monitoring of form modifications and user role changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Forminator → Version. If version is 1.35.1 or lower, you are vulnerable.Check Version:
wp plugin get forminator --field=versionVerify Fix Applied:
Confirm Forminator version is 1.35.2 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unauthorized form creation/modification by non-admin users
- User registration forms being modified to set default role to administrator
- New administrator accounts created unexpectedly
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with forminator-related actions from non-admin users
SIEM Query:
source="wordpress.log" AND ("forminator" AND ("create_form" OR "update_form" OR "user_registration")) AND user_role!="administrator"