CVE-2024-31077: Incsub Forminator SQLi Vulnerability

CVE-2024-31077 Overview

CVE-2024-31077 is a SQL injection vulnerability in Incsub Forminator, a WordPress form builder plugin. Versions prior to 1.29.3 fail to sanitize input passed to database queries. An authenticated attacker with administrative privileges can inject arbitrary SQL statements through the plugin's interfaces.

Successful exploitation allows the attacker to read and modify any data stored in the WordPress database. The attacker can also trigger a denial-of-service (DoS) condition against the underlying database. The flaw is tracked under CWE-89 and requires network access to the WordPress admin surface.

Critical Impact
A remote authenticated administrator can read, alter, or destroy arbitrary database contents and induce database-level denial of service on affected WordPress sites.

Affected Products

Incsub Forminator WordPress plugin versions prior to 1.29.3
WordPress sites distributing the free Forminator plugin from the WordPress plugin repository
WPMU DEV-managed sites running vulnerable Forminator builds

Discovery Timeline

2024-04-23 - CVE-2024-31077 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-31077

Vulnerability Analysis

Forminator is a form, quiz, poll, and payment builder plugin for WordPress with a large installed base. The vulnerable code paths accept attacker-controlled input from administrative form-management operations and concatenate that input into SQL statements. Because the plugin does not enforce parameterized queries or strict input validation on these paths, the database engine executes attacker-supplied SQL.

Exploitation requires an authenticated session with administrative privileges on the target WordPress instance. This precondition narrows the attacker population, but the impact once achieved is broad. The attacker gains read and write access to every table WordPress can reach, including user credentials, session tokens, plugin secrets, and site content.

The EPSS score of 30.361% places this issue in the 98th percentile for exploitation likelihood among published CVEs, reflecting active interest in Forminator vulnerabilities.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. Forminator concatenates untrusted input into SQL strings instead of binding parameters through the WordPress $wpdb->prepare() API. The plugin's administrative endpoints trust input from privileged users and forward it to database queries without escaping.

Attack Vector

The attack vector is network-based against the WordPress administrative interface. An attacker who holds administrator credentials, or who has hijacked an administrator session, submits crafted parameters to a vulnerable Forminator endpoint. The injected SQL executes with the privileges of the WordPress database user, which typically holds full rights over the site database.

Verified proof-of-concept code is not publicly available. See the JVN Security Advisory JVN50132400 for coordinated disclosure details.

Detection Methods for CVE-2024-31077

Indicators of Compromise

Unexpected entries in the WordPress wp_users or wp_options tables that do not correspond to legitimate administrative changes
Web server access logs showing administrator requests to Forminator endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP(
Database error log entries referencing malformed queries originating from the Forminator plugin
Unexplained database CPU spikes or connection saturation correlated with Forminator admin activity

Detection Strategies

Inventory all WordPress instances and identify Forminator plugin versions below 1.29.3
Enable WordPress database query logging on staging instances to profile normal Forminator query patterns and flag deviations
Alert on administrative HTTP POST requests to /wp-admin/admin-ajax.php and Forminator handler paths that contain SQL keywords in parameter values

Monitoring Recommendations

Forward WordPress, PHP, and MySQL/MariaDB logs to a centralized SIEM for correlation
Monitor administrator account logins for anomalous source addresses, times, or user agents that could indicate credential compromise
Track database schema changes and privileged query volume from the WordPress database user

How to Mitigate CVE-2024-31077

Immediate Actions Required

Upgrade Forminator to version 1.29.3 or later on every WordPress site in the environment
Rotate WordPress administrator passwords and invalidate active administrator sessions after patching
Audit the wp_users, wp_usermeta, and wp_options tables for unauthorized modifications
Restrict access to /wp-admin/ by IP allowlist or VPN where operationally feasible

Patch Information

Incsub released Forminator 1.29.3 to fix the SQL injection. Administrators should install the update through the WordPress plugin manager or download it from the Forminator plugin page. Additional vendor guidance is available at WPMU DEV and in JVN50132400.

Workarounds

Temporarily deactivate the Forminator plugin until the patched version is installed
Enforce multi-factor authentication on all WordPress administrator accounts to reduce the risk of privileged account misuse
Deploy a web application firewall (WAF) rule that inspects requests to Forminator admin endpoints for SQL injection payloads

bash

# Update Forminator to the patched version using WP-CLI
wp plugin update forminator --version=1.29.3

# Verify the installed version across a multisite network
wp plugin get forminator --field=version