Description
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Forminator Forms | 1.40.0 – < 1.57.0.5 | 1.57.0.5 |
References
- https://wpscan.com/vulnerability/5aa85c72-2a60-4243-b370-ef0b46e98cfe/ exploit vdb-entry technical-description