The Forminator Forms plugin for WordPress contains a CSRF vulnerability due to improper nonce validation in the quiz creation functionality. This flaw enables attackers to forge requests that cause an authenticated site administrator to unknowingly create draft quizzes. The vulnerability affects all plugin versions up to 1.35.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No official patch or remediation details have been provided by the vendor as of the publication date.

An attacker can exploit this vulnerability to cause an authenticated administrator to create draft quizzes without their intent, potentially leading to unauthorized content creation or administrative disruption. There is no direct confidentiality, availability, or high integrity impact reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution with links and requests that could trigger quiz creation actions. Monitoring for updates from the vendor or plugin maintainers is recommended.