The Forminator Forms plugin for WordPress versions up to 1.51.1 suffers from a missing authorization vulnerability (CWE-862) in the processRequest() method of the Forminator_Admin_Module_Edit_Page class. This method dispatches sensitive actions like export, delete, clone, and publish/draft changes after only verifying a nonce ('forminator_form_request') but does not check if the user has the 'manage_forminator_modules' capability. The nonce is embedded in JavaScript on all Forminator admin pages, including those accessible to users without module-management permissions. Because processRequest() is called during the admin_menu hook, which runs before WordPress enforces page-level capability checks, low-privilege authenticated users (e.g., subscribers) can exploit this to perform unauthorized actions on form modules.

An authenticated attacker with low privileges (such as subscriber-level access) can export sensitive internal configurations of forms, including notification routing and integration credentials, delete modules or all submissions, clone modules, and bulk-change their publish status. This compromises confidentiality of form data and configuration but does not affect integrity or availability beyond the described actions. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Until a patch is available, restrict access to Forminator admin pages to trusted users only and monitor for suspicious activity. Avoid granting unnecessary Forminator roles to low-privilege users. Follow vendor updates closely for an official fix.