Threats tagged 'ghsa-j4f8-pmw5-f47j'

The Forminator Forms WordPress plugin up to version 1.57.3.1 contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'previous_draft_id' parameter. This flaw allows unauthenticated attackers who have obtained a victim's draft ID (e.g., from a shared 'continue later' link) to delete and overwrite saved drafts belonging to other users. The nonce intended to protect this action is publicly accessible and does not prevent exploitation.