The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a missing capability check (CWE-862) in all versions up to 1.35.1. This flaw permits authenticated attackers with Contributor-level access and permissions delegated by an Administrator to create or edit forms, including modifying User Registration forms to assign the Administrator role by default. The vulnerability is network exploitable with low privileges required but high attack complexity. It impacts confidentiality, integrity, and availability, reflected in a CVSS 3.1 base score of 7.5.

An attacker with Contributor-level access can exploit this vulnerability to escalate privileges by altering form configurations, including setting the default registration role to Administrator. This can lead to full administrative control over the WordPress site, compromising confidentiality, integrity, and availability of the affected system. No known exploits are currently reported, but the potential impact is high due to privilege escalation capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access and higher to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once available.