CVE-2024-9700 Overview
CVE-2024-9700 is an Insecure Direct Object Reference (IDOR) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.36.0. The submit_quizzes() function fails to validate the user-controlled entry_id parameter, allowing unauthenticated attackers to modify quiz submissions belonging to other users. The weakness maps to [CWE-639] Authorization Bypass Through User-Controlled Key. The vendor, WPMU DEV, addressed the issue in changeset 3172942 published through the WordPress plugin repository.
Critical Impact
Unauthenticated remote attackers can tamper with arbitrary quiz submission records stored by the Forminator plugin, compromising data integrity across WordPress sites.
Affected Products
- WPMU DEV Forminator Forms plugin for WordPress, all versions up to and including 1.36.0
- Free distribution of Forminator Forms available via the WordPress plugin repository
- WordPress sites running the vulnerable quiz module exposed through front-action.php
Discovery Timeline
- 2024-10-31 - CVE-2024-9700 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9700
Vulnerability Analysis
The Forminator plugin provides form building capabilities including quiz modules that record user submissions. The submit_quizzes() function in library/modules/quizzes/front/front-action.php processes incoming quiz data and references an entry_id field supplied by the client. The handler trusts the submitted entry_id as the authoritative identifier for the record to update without verifying that the caller owns or is authorized to modify that entry.
An attacker can submit a crafted request with any valid entry_id and overwrite the stored submission. Because the endpoint accepts unauthenticated input, exploitation requires no account on the target site. The impact is limited to integrity of quiz entries; the vulnerability does not expose data confidentiality or cause service disruption.
Root Cause
The root cause is missing authorization checks on a user-controlled object reference. The submit_quizzes() handler reads the entry_id key from the request and uses it to locate and update a database row without comparing it to session state, nonces tied to the specific entry, or ownership metadata. This pattern is the defining characteristic of an Insecure Direct Object Reference flaw classified under [CWE-639].
Attack Vector
Exploitation occurs over the network against the WordPress AJAX endpoint used by the Forminator quiz module. An attacker iterates or guesses entry_id values and submits replacement quiz data in each request. No authentication, user interaction, or elevated privileges are required. See the WordPress Forminator Code Review for the vulnerable source location and the Wordfence Vulnerability Report for additional technical context.
// No verified proof-of-concept code is available for this CVE.
// Refer to the vendor advisory and Wordfence report linked above for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-9700
Indicators of Compromise
- Unexpected modifications to Forminator quiz entries where submission timestamps or content differ from the originating user activity
- Web server access logs showing repeated POST requests to the Forminator AJAX endpoint with incrementing or enumerated entry_id values
- Quiz entries updated from source IP addresses that do not match the IP recorded at initial submission
Detection Strategies
- Review Forminator database tables for quiz submissions that were updated after their initial creation and correlate with web request logs
- Deploy web application firewall (WAF) rules that flag unauthenticated requests to the Forminator quiz submission handler containing an entry_id parameter
- Enable WordPress audit logging to track changes to plugin data tables and alert on anomalous update patterns
Monitoring Recommendations
- Monitor outbound responses from the quiz endpoint for high volumes of successful updates originating from a single source
- Track the installed Forminator plugin version across WordPress estates and alert when versions at or below 1.36.0 are detected
- Correlate web server telemetry with database modification events to identify unauthorized entry tampering
How to Mitigate CVE-2024-9700
Immediate Actions Required
- Upgrade the Forminator Forms plugin to a version later than 1.36.0 that contains changeset 3172942
- Audit existing quiz submissions for unauthorized modifications and restore from backup where tampering is confirmed
- Restrict access to the WordPress AJAX endpoint using WAF rules while patching is in progress
Patch Information
WPMU DEV fixed the authorization check in WordPress Changeset #3172942. The patch adds validation to confirm that the submitter is authorized to modify the referenced entry_id before persisting changes. Site administrators should apply the update through the WordPress plugin manager or by deploying the fixed plugin package.
Workarounds
- Disable the Forminator quiz module on affected sites until the patched plugin version is deployed
- Block unauthenticated POST requests to the Forminator quiz submission endpoint at the WAF or reverse proxy layer
- Remove or deactivate the Forminator plugin on sites that do not require quiz functionality
# Update the Forminator plugin using WP-CLI
wp plugin update forminator
wp plugin get forminator --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
