CVE-2024-9352
📋 TL;DR
This CSRF vulnerability in the Forminator WordPress plugin allows unauthenticated attackers to create draft forms by tricking administrators into clicking malicious links. All WordPress sites using Forminator versions up to 1.35.1 are affected. The attack requires social engineering to get an administrator to perform an action.
💻 Affected Systems
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder for WordPress
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create malicious forms that collect sensitive user data, redirect to phishing sites, or enable further attacks through form submissions.
Likely Case
Spam forms created on the site that could damage reputation or create administrative cleanup work.
If Mitigated
No impact if proper CSRF protections are in place or administrators don't click malicious links.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators but technical complexity is low once the link is clicked.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.35.2 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3169243/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Forminator plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 1.35.2+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate Forminator plugin until patched
wp plugin deactivate forminator
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers
- Use browser extensions that block CSRF attempts and educate administrators about phishing risks
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Forminator → Version number. If version is 1.35.1 or lower, you are vulnerable.Check Version:
wp plugin get forminator --field=versionVerify Fix Applied:
After updating, verify Forminator version is 1.35.2 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual form creation events in WordPress logs
- Multiple draft forms created in short timeframes
Network Indicators:
- POST requests to /wp-admin/admin-ajax.php with action=forminator_create_module without proper referrer headers
SIEM Query:
source="wordpress.log" AND "forminator_create_module" AND NOT referer="*wp-admin*"