The Forminator Forms plugin for WordPress contains a missing authorization check in its export scheduling functionality. The listen_for_saving_export_schedule() function fails to verify user permissions, allowing any authenticated user with subscriber-level access to create a scheduled export that emails all form submissions to a specified address. This flaw can lead to the exfiltration of sensitive form data. The vulnerability is rooted in improper access control (CWE-862).

WordPress sites that have the Forminator Forms plugin installed with a version of 1.53.0 or earlier are affected. This includes any site using the wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin in the specified versions.

The reported CVSS score of 6.5 indicates a medium severity risk. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker must be logged into the site with any role that can run the export scheduling code—namely a subscriber-level account. Once authenticated, the attacker can craft a scheduled export job and receive all form submissions via email, potentially revealing confidential information. The exploit path is purely authenticated; no network or local privilege escalation is required, making the flaw amenable to exploitation by any user with legitimate credentials.