CVE-2024-10402

The Forminator Forms plugin through version 1.35.1 contains a capability check vulnerability that allows authenticated users with Contributor-level permissions or higher to perform unauthorized actions. Attackers with these privileges can create new forms or modify existing ones, and critically can change the default registration role to Administrator on User Registration forms, potentially allowing privilege escalation. The flaw stems from missing authorization validation on a vulnerable function that does not properly restrict access based on user capabilities.

Based on public CVE data (MITRE/NVD).