The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a missing authorization check (CWE-862) in the 'listen_for_csv_export' function. This flaw allows authenticated users with limited privileges to bypass intended access controls and export sensitive form data, potentially exposing personally identifiable information. The vulnerability affects all versions up to and including 1.49.1. The CVSS 3.1 base score is 5.3, reflecting a network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with authenticated access to the Forminator dashboard can export sensitive form submission data without proper authorization. This could lead to unauthorized disclosure of personally identifiable information collected via contact, payment, or custom forms. There is no indication of impact on data integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict dashboard access to trusted users only to reduce risk. Monitor vendor channels for updates regarding a security patch addressing this authorization bypass.