The Forminator Forms plugin processes module-management actions after only validating a nonce, without checking the user’s capability. This allows an attacker who can log into WordPress but only has low-privilege Forminator roles (e.g., Subscriber) to craft authenticated requests that export, delete, clone, or otherwise alter form modules, exposing configuration data such as notification routes, integration credentials, and conditional logic.

Forminator Forms, a WordPress plugin provided by wpmudev, is affected in all releases up to and including 1.51.1. Users running version 1.51.1 or earlier are at risk; newer releases (e.g., 1.52 and beyond) contain a fix that enforces the required capability check.

The CVSS score of 5.3 indicates a moderate severity. Because the flaw requires only an authenticated user with a low privilege role, the likelihood of exploitation is high in environments where such roles are commonly granted. The vulnerability is not recorded in CISA KEV and no EPSS score is available. An attacker can craft a POST request containing a valid nonce and the 'forminator_action' parameter, which is exposed on all Forminator admin pages, to trigger the vulnerable actions before WordPress performs capability checks during the admin_menu hook.