The Forminator Forms plugin for WordPress has an authorization bypass in all versions up to 1.49.1 through the listen_for_csv_export function. The plugin does not verify that the requesting user can export data, so any authenticated user who can access the Forminator dashboard can download CSV files containing sensitive form submissions, including personally identifiable information. This missing‑authorization flaw (CWE‑862) results in a confidentiality compromise of the data collected by the plugin.

The vulnerability affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin developed by WpMudev. All releases numbered 1.49.1 and earlier are susceptible. Any WordPress site that uses the plugin and grants dashboard access to users is at risk; updating to any version above 1.49.1 removes the flaw.

The CVSS score of 5.3 indicates moderate severity and the EPSS value of less than 1 % suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and no public exploit has been disclosed. The attacker must first authenticate to the WordPress site and have dashboard access; once those conditions are satisfied, the CSV export can be invoked without additional privileges, allowing large volumes of data to be exfiltrated.