CVE-2024-9352

The Forminator Forms plugin, used in WordPress installations, contains a security flaw that allows unauthorized access to its functionality. Specifically, the "create_module" function within the custom form creation process lacks proper validation of nonces, which are tokens used to verify the authenticity of requests. As a result, an attacker can craft a malicious link that, when clicked by an administrator, enables them to create draft forms without needing authentication.

Based on public CVE data (MITRE/NVD).