The Forminator Forms plugin for WordPress versions up to and including 1.51.1 suffers from a Missing Authorization vulnerability. This flaw allows authenticated users with low privileges, such as subscribers or custom roles restricted to Templates or Reports, to perform sensitive module-management actions without proper capability checks. Actions affected include exporting form configurations, deleting modules or entries, cloning modules, and changing publish status. The vulnerability arises because the processRequest() method only verifies a nonce but not user capabilities, and the nonce is accessible on admin pages even to low-privilege users.