CVE-2024-10402 Overview
CVE-2024-10402 affects the Forminator Forms plugin for WordPress, developed by wpmudev. The plugin is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to and including 1.35.1. Authenticated users with Contributor-level access and above can create new or edit existing forms. Attackers can update the default registration role on User Registration forms to Administrator, enabling privilege escalation across the site. The vulnerability is classified under CWE-862 (Missing Authorization).
Critical Impact
Contributor-level attackers can modify User Registration forms to assign Administrator role to new registrants, leading to full site compromise.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All versions up to and including 1.35.1
- Free distribution channel on the WordPress plugin directory
Discovery Timeline
- 2024-10-26 - CVE-2024-10402 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10402
Vulnerability Analysis
The Forminator Forms plugin exposes form management functionality through an AJAX or administrative endpoint that lacks a proper capability check. The function processes requests without validating whether the caller has the required WordPress capability such as manage_options or a form-specific permission. As a result, any authenticated user granted access to the plugin by an Administrator, starting at the Contributor role, can invoke the function to create or modify forms. The most severe consequence involves User Registration forms, where the default role assigned to newly registered users can be changed to Administrator. Once modified, any subsequent registration through the form grants full administrative control of the WordPress site.
Root Cause
The root cause is a missing capability check on a plugin function that handles form creation and updates. The affected code path relies on nonce verification or authentication alone, without enforcing WordPress role-based authorization through current_user_can(). This mapping error falls under CWE-862, Missing Authorization, and is a common weakness in WordPress plugins that surface administrative functionality through shared endpoints.
Attack Vector
An attacker requires an authenticated Contributor account or higher and must have been granted plugin access by an Administrator. The attacker submits a crafted request to the vulnerable function, either creating a new User Registration form or modifying an existing one so the default registration role is set to Administrator. The attacker then triggers a user registration through the manipulated form to obtain an Administrator account. See the Wordfence Vulnerability Report and WordPress Plugin Changeset for technical details of the fix.
Detection Methods for CVE-2024-10402
Indicators of Compromise
- Unexpected changes to Forminator User Registration form settings, particularly the default registration role field set to administrator.
- New WordPress user accounts holding the Administrator role created through public registration forms.
- Modifications to Forminator form definitions performed by Contributor, Author, or Editor accounts.
- Entries in the plugin's activity or WordPress audit log showing form updates from lower-privileged users.
Detection Strategies
- Audit the wp_options table and Forminator form configuration for User Registration forms whose default role is set to Administrator.
- Compare current plugin form definitions against known-good backups to identify unauthorized changes.
- Monitor WordPress admin-ajax.php and REST API traffic for Forminator form-management actions originating from non-administrator sessions.
Monitoring Recommendations
- Enable WordPress audit logging to track user role changes, form modifications, and privilege escalations.
- Alert on any creation of Administrator accounts outside of authorized provisioning workflows.
- Review Contributor, Author, and Editor account activity for access to plugin management endpoints.
How to Mitigate CVE-2024-10402
Immediate Actions Required
- Update the Forminator Forms plugin to a version later than 1.35.1 on all WordPress sites.
- Review every Forminator User Registration form and reset the default registration role to subscriber or another least-privilege role.
- Audit existing WordPress users and remove any Administrator accounts that cannot be attributed to authorized provisioning.
- Rotate credentials and session tokens for all administrative users if unauthorized changes are found.
Patch Information
The vendor addressed the missing capability check in the plugin update referenced by the WordPress Plugin Changeset 3169243. Site owners should upgrade to the latest available release of Forminator Forms distributed through the WordPress plugin repository. Additional advisory details are available in the Wordfence Vulnerability Report.
Workarounds
- Revoke Forminator plugin access from all Contributor, Author, and Editor accounts until the plugin can be updated.
- Disable public user registration in WordPress general settings to prevent abuse of manipulated registration forms.
- Temporarily deactivate the Forminator Forms plugin on sites that cannot be updated immediately.
- Restrict access to wp-admin and admin-ajax.php by IP address using a web application firewall or server-level rules.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
