WordPress Forminator IDOR Vulnerability (CVE-2024-9700) Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Forminator Forms - Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation 2. Vulnerability Description: - Describes a vulnerability in the Forminator Forms plugin that allows an unauthenticated attacker to modify other users' quiz submissions due to missing validation on the user-controlled key. 3. Vulnerability Rating: - CVSS Score: 3.1 - CVSS Score: 5.3 (Medium) 4. Public Disclosure Date: October 30, 2024 5. Last Updated Date: October 31, 2024 6. Researcher: Vijaysimha Reddy 7. Fix Status: Fixed 8. Affected Versions: <= 1.36.0 9. Fixed Version: 1.36.1 10. Vulnerability ID: CVE-2024-9700 11. Vulnerability Type: Authorization Bypass Through User-Controlled Key 12. Vulnerability Disclosure: Public 13. Vulnerability Disclosure Date: October 30, 2024 14. Vulnerability Disclosure Date: October 31, 2024 15. Vulnerability Disclosure Date: October 31, 2024 16. Vulnerability Disclosure Date: October 31, 2024 17. Vulnerability Disclosure Date: October 31, 2024 18. Vulnerability Disclosure Date: October 31, 2024 19. Vulnerability Disclosure Date: October 31, 2024 20. Vulnerability Disclosure Date: October 31, 2024 21. Vulnerability Disclosure Date: October 31, 2024 22. Vulnerability Disclosure Date: October 31, 2024 23. Vulnerability Disclosure Date: October 31, 2024 24. Vulnerability Disclosure Date: October 31, 2024 25. Vulnerability Disclosure Date: October 31, 2024 26. Vulnerability Disclosure Date: October 31, 2024 27. Vulnerability Disclosure Date: October 31, 2024 28. Vulnerability Disclosure Date: October 31, 2024 29. Vulnerability Disclosure Date: October 31, 2024 30. Vulnerability Disclosure Date: October 31, 2024 31. Vulnerability Disclosure Date: October 31, 2024 32. Vulnerability Disclosure Date: October 31, 2024 33. Vulnerability Disclosure Date: October 31, 2024 34. Vulnerability Disclosure Date: October 31, 2024 35. Vulnerability Disclosure Date: October 31, 2024 36. Vulnerability Disclosure Date: October 31, 2024 37. Vulnerability Disclosure Date: October 31, 2024 38. Vulnerability Disclosure Date: October 31, 2024 39. Vulnerability Disclosure Date: October 31, 2024 40. Vulnerability Disclosure Date: October 31, 2024 41. Vulnerability Disclosure Date: October 31, 2024 42. Vulnerability Disclosure Date: October 31, 2024 43. Vulnerability Disclosure Date: October 31, 2024 44. Vulnerability Disclosure Date: October 31, 2024 45. Vulnerability Disclosure Date: October 31, 2024 46. Vulnerability Disclosure Date: October 31, 2024 47. Vulnerability Disclosure Date: October 31, 2024 48. Vulnerability Disclosure Date: October 31, 2024 49. Vulnerability Disclosure Date: October 31, 2024 50. Vulnerability Disclosure Date: October 31, 2024 51. Vulnerability Disclosure Date: October 31, 2024 52. Vulnerability Disclosure Date: October 31, 2024 53. Vulnerability Disclosure Date: October 31, 2024 54. Vulnerability Disclosure Date: October 31, 2024 55. Vulnerability Disclosure Date: October 31, 2024 56. Vulnerability Disclosure Date: October 31, 2024 57. Vulnerability Disclosure Date: October 31, 2024 58. Vulnerability Disclosure Date: October 31, 2024 59. Vulnerability Disclosure Date: October 31, 2024 60. Vulnerability Disclosure Date: October 31, 2024 61. Vulnerability Disclosure Date: October 31, 2024 62. Vulnerability Disclosure Date: October 31, 2024 63. Vulnerability Disclosure Date: October 31, 2024 64. Vulnerability Disclosure Date: October 31, 2024 65. Vulnerability Disclosure Date: October 31, 2024 66. Vulnerability Disclosure Date: October 31, 2024 67. Vulnerability Disclosure Date: October 31, 2024 68. Vulnerability Disclosure Date: October 31, 2024 69. Vulnerability Disclosure Date: October 31, 2024 70. Vulnerability Disclosure Date: October 31, 2024 71. Vulnerability Disclosure Date: October 31, 2024 72. Vulnerability Disclosure Date: October 31, 2024 73. Vulnerability Disclosure Date: October 31, 2024 74. Vulnerability Disclosure Date: October 31, 2024 75. Vulnerability Disclosure Date: October 31, 2024 76. Vulnerability Disclosure Date: October 31, 2024 77. Vulnerability Disclosure Date: October 31, 2024 78. Vulnerability Disclosure Date: October 31, 2024 79. Vulnerability Disclosure Date: October 31, 2024 80. Vulnerability Disclosure Date: October 31, 2024 81. Vulnerability Disclosure Date: October 31, 2024 82. Vulnerability Disclosure Date: October 31, 2024 83. Vulnerability Disclosure Date: October 31, 2024 84. Vulnerability Disclosure Date: October 31, 2024 85. Vulnerability Disclosure Date: October 31, 2024 86. Vulnerability Disclosure Date: October 31, 2024 87. Vulnerability Disclosure Date: October 31, 2024 88. Vulnerability Disclosure Date: October 31, 2024 89. Vulnerability Disclosure Date: October 31, 2024 90. Vulnerability Disclosure Date: October 31, 2024 91. Vulnerability Disclosure Date: October 31, 2

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Forminator IDOR Vulnerability (CVE-2024-9700) Advisory

More from this source