PT-2024-38317 · WordPress · Forminator

Sean Murphy + 1 · Published 2024-08-02 · Updated 2024-08-13 · CVE-2024-7389

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forminator plugin for WordPress versions up to, and including, 1.29.1

Description The issue allows unauthenticated attackers to extract the HubSpot integration developer API key, making unauthorized changes to the plugin's HubSpot integration possible. This can also lead to the exposure of personally identifiable information from plugin users using the HubSpot integration. The vulnerability is related to the class-forminator-addon-hubspot-wp-api.php file.

Recommendations For versions up to, and including, 1.29.1: Patch immediately and rotate any exposed credentials. As a temporary workaround, consider restricting access to the class-forminator-addon-hubspot-wp-api.php file until a patch is available.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-7389

Affected Products

Forminator

References · 9

• 🔥 https://vicarius.io/vsociety/posts/source-code-dive-to-hunt-for-secrets-in-forminator-code-cve-2024-7389 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7389 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-7389 · Security Note
• https://t.me/cvedetector/2327 · Telegram Post
• https://developers.hubspot.com/docs/api/webhooks#scopes · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve · Note
• https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api · Note
• https://twitter.com/oktsec/status/1823317116604289481 · Twitter Post