The Forminator plugin for WordPress contains a sensitive information exposure vulnerability (CWE-522) in the class-forminator-addon-hubspot-wp-api.php file. This flaw allows unauthenticated attackers to retrieve the HubSpot integration developer API key, which could be used to manipulate the plugin's integration or access personally identifiable information of users connected through HubSpot. The vulnerability affects all versions up to 1.29.1 and has a CVSS 3.1 base score of 7.5, reflecting a high severity with network attack vector, no privileges required, and no user interaction needed.

An attacker exploiting this vulnerability can obtain the HubSpot developer API key without authentication. This exposure can lead to unauthorized modifications of the plugin's HubSpot integration and potential leakage of personally identifiable information from users relying on this integration. The impact is limited to confidentiality as there is no direct integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the HubSpot integration in the Forminator plugin or restricting access to the vulnerable PHP file via web server configuration to prevent unauthorized access. Monitor vendor channels for updates and apply patches promptly once available.