The Forminator Forms plugin for WordPress suffers from a missing authorization vulnerability (CWE-862) in versions up to 1.53.0. Specifically, the listen_for_saving_export_schedule() function in library/class-export.php fails to verify user capabilities before saving scheduled export configurations. This contrasts with the listen_for_csv_export() function, which correctly performs permission checks. As a result, authenticated users with minimal privileges (subscriber-level) can create scheduled export jobs that send all form submissions to an attacker-controlled email address, leading to sensitive data exposure. The CVSS 3.1 base score is 6.5 (medium severity) with network attack vector, low attack complexity, and privileges required at the low level.

An attacker with subscriber-level access can exploit this vulnerability to exfiltrate sensitive data submitted through forms by configuring scheduled exports to email data to an attacker-controlled address. This compromises confidentiality but does not affect data integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for unusual scheduled export configurations. Avoid granting unnecessary permissions to low-privilege users.