PT-2024-39769 · WordPress · Forminator Forms

Vijaysimha + 1 · Published 2024-10-30 · Updated 2024-11-25 · CVE-2024-9700

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.36.0

Description The issue is related to Insecure Direct Object Reference, which allows unauthenticated attackers to modify other users' quiz submissions due to missing validation on the entry id user-controlled key. This is possible via the submit quizzes() function.

Recommendations For versions up to, and including, 1.36.0, update to a version that includes a fix for this issue. As a temporary workaround, consider disabling the submit quizzes() function until a patch is available. Restrict access to the entry id key to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-9700

Affected Products

Forminator Forms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-9700 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9700 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3172942 · Patch
• https://twitter.com/CVEnew/status/1851861951808209257 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=cve · Note
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.35.1/library/modules/quizzes/front/front-action.php#L548 · Note
• https://twitter.com/UndercodeNews/status/1861159006682730771 · Twitter Post
• https://t.me/cvenotify/100129 · Telegram Post
• https://t.me/cvedetector/9489 · Telegram Post