The Forminator Forms plugin for WordPress contains a missing authorization vulnerability (CWE-862) in its `processRequest()` method within the `Forminator_Admin_Module_Edit_Page` class. This method dispatches sensitive actions such as export, delete, clone, and publish/draft changes after verifying only a nonce (`forminator_form_request`) without confirming the user's capability to manage modules. The nonce is globally exposed on all Forminator admin pages, including those accessible to low-privilege users. Because `processRequest()` runs during the `admin_menu` hook, which occurs before WordPress enforces page-level capability checks, authenticated users with minimal privileges can craft POST requests to perform unauthorized actions on any published module. This leads to unauthorized export of internal configurations (including sensitive integration credentials), deletion of modules and entries, cloning, and bulk status changes.

An attacker with authenticated low-level access (e.g., subscriber role) can exploit this vulnerability to export sensitive internal configurations of forms, including notification routing and integration credentials, delete modules and all form submissions, clone modules, and change their publish status. This compromises confidentiality of sensitive data and integrity of form modules but does not affect availability or allow privilege escalation beyond these actions. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, high complexity, low privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — no official fix or vendor advisory is provided in the available data. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to the Forminator plugin admin pages to trusted users only and consider disabling or limiting the plugin's use where possible. Avoid granting unnecessary roles or permissions to low-privilege users. Do not rely solely on the nonce for authorization as it is insufficient in this case.