The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from an authorization bypass vulnerability (CWE-639) identified as CVE-2024-9700. The issue arises from the submit_quizzes() function failing to validate the 'entry_id' parameter, which is user-controlled. This allows unauthenticated attackers to manipulate quiz submission data of other users. The vulnerability affects all versions up to 1.36.0. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or vendor advisory is currently available.

An attacker can modify quiz submissions of other users without authentication, potentially undermining data integrity within the Forminator Forms plugin. There is no impact on confidentiality or availability. The integrity impact is low, meaning the attacker can alter data but cannot escalate privileges or disrupt service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected functionality or disabling the quiz submission feature if feasible. Monitor for vendor updates and apply patches promptly once available.