CVE-2024-9352 Overview
The Forminator Forms plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.35.1. The flaw resides in the custom form create_module function, which lacks proper nonce validation. Unauthenticated attackers can craft a malicious link that, when clicked by an authenticated site administrator, causes the WordPress site to create draft forms without the administrator's intent. The vulnerability is tracked under CWE-352 and requires user interaction to succeed.
Critical Impact
Unauthenticated attackers can create arbitrary draft forms on affected WordPress sites by tricking administrators into clicking crafted links, enabling unauthorized modification of plugin state.
Affected Products
- Wpmudev Forminator Forms plugin for WordPress
- All versions up to and including 1.35.1
- Free distribution on the WordPress plugin repository
Discovery Timeline
- 2024-10-17 - CVE-2024-9352 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9352
Vulnerability Analysis
The Forminator Forms plugin exposes a create_module function within its custom forms administrative loader. This handler creates new form modules but does not validate a WordPress nonce token before performing the state-changing action. Without nonce verification, WordPress cannot confirm that a request originated from a legitimate administrator session on the site itself.
An attacker can host a crafted page or link that issues a request to the vulnerable endpoint. When an authenticated administrator visits the attacker-controlled resource, the browser submits the request with the administrator's session cookies attached. The plugin then processes the request as if the administrator initiated it. The impact is limited to integrity: attackers can create draft forms but cannot read data or take the site offline.
Root Cause
The root cause is missing or incorrect nonce validation on the create_module handler in library/modules/custom-forms/admin/admin-loader.php. WordPress provides wp_verify_nonce() and check_admin_referer() helpers specifically to prevent CSRF. Neither guard was invoked on the affected code path, leaving the state-changing action reachable via forged cross-origin requests.
Attack Vector
Exploitation requires an authenticated administrator to interact with attacker-controlled content, typically by clicking a link or visiting a page that auto-submits a form. The attacker does not need credentials or prior access to the target site. The vulnerable endpoint accepts the forged request because it lacks the nonce token WordPress uses to bind requests to a specific user session.
The vulnerability mechanism is documented in the WordPress plugin admin loader source and analyzed in the Wordfence Vulnerability Analysis. No public proof-of-concept exploit has been published.
Detection Methods for CVE-2024-9352
Indicators of Compromise
- Unexpected draft forms appearing in the Forminator Forms administrative interface
- Form creation events in WordPress logs that do not correlate with legitimate administrator activity
- HTTP POST requests to Forminator custom form endpoints lacking a valid _wpnonce parameter
- Referer headers on form creation requests pointing to external, untrusted domains
Detection Strategies
- Audit the Forminator Forms module list for draft forms created outside change-management windows
- Review web server access logs for POST requests to admin-ajax.php or Forminator admin endpoints originating from external Referers
- Correlate WordPress administrator session activity with form creation timestamps to identify anomalies
Monitoring Recommendations
- Enable WordPress audit logging plugins to capture form creation, modification, and deletion events
- Forward WordPress and web server logs to a centralized platform for cross-source correlation and retention
- Alert on form creation events where the HTTP Referer header is missing or points to a non-site origin
How to Mitigate CVE-2024-9352
Immediate Actions Required
- Upgrade the Forminator Forms plugin to a version newer than 1.35.1 that includes the fix from WordPress Changeset #3169243
- Review existing forms and delete any unrecognized draft entries created without administrator approval
- Rotate administrator credentials if unauthorized activity is confirmed in logs
Patch Information
The vendor addressed the vulnerability in WordPress Changeset #3169243, which adds nonce validation to the create_module handler. Site administrators should apply the plugin update through the WordPress admin console or enable automatic plugin updates for Forminator Forms.
Workarounds
- Deactivate the Forminator Forms plugin until the patched version can be deployed
- Restrict WordPress administrator access to trusted networks using a web application firewall or IP allowlist
- Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for administration
# Update Forminator Forms via WP-CLI
wp plugin update forminator
# Verify installed version is above 1.35.1
wp plugin get forminator --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
