The Forminator Forms plugin for WordPress contains a missing authorization vulnerability (CWE-862) in versions up to 1.53.0. Specifically, the listen_for_saving_export_schedule() function in library/class-export.php does not perform a capability check before saving scheduled export configurations, unlike the similar listen_for_csv_export() function which correctly verifies user permissions. This flaw allows authenticated attackers with low privileges (subscriber-level) to create scheduled export jobs that send all form submissions to an email address they control, resulting in unauthorized data exfiltration.

An attacker with subscriber-level access can exploit this vulnerability to exfiltrate sensitive data submitted through forms by configuring scheduled exports to attacker-controlled email addresses. The confidentiality of form submission data is compromised. There is no impact on system integrity or availability. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities or disable scheduled export features if possible to reduce risk. Monitor vendor channels for updates and apply official patches once released.