The Forminator Forms WordPress plugin before version 1.57.2.1 suffers from a missing authorization vulnerability (CWE-862) in its saved-draft notification feature. The plugin fails to associate the notification with the visitor who created the draft and accepts both the recipient email address and the embedded link from the request parameters. Consequently, unauthenticated attackers can cause the site to send emails to arbitrary recipients containing attacker-chosen links. The authorization token required to send these messages is issued by the plugin itself to anonymous users and can be replayed without limitation, enabling repeated abuse.

Unauthenticated attackers can abuse the site’s mail configuration to send emails to arbitrary recipients with attacker-controlled content, potentially facilitating phishing or spam campaigns that appear to originate from the vulnerable site. The unlimited replay of the authorization token increases the risk and scale of abuse. This could damage the site's reputation and trustworthiness.

A fix is available in Forminator Forms version 1.57.2.1. Users should upgrade to this version or later to remediate the vulnerability. Until patched, restrict access to the affected functionality or implement additional access controls if possible.