CVE-2025-14782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14782", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-16T13:20:01.928Z", "datePublished": "2026-01-09T06:34:53.334Z", "dateUpdated": "2026-04-08T16:43:38.865Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:38.865Z"}, "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.49.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information."}], "title": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-12-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-12-16T13:35:32.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-08T17:47:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T18:21:23.163240Z", "id": "CVE-2025-14782", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:21:33.203Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T18:21:23.163240Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:21:29.099Z"}}], "cna": {"title": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wpmudev", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.49.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-12-16T13:35:32.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-08T17:47:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php"}], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:38.865Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14782", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:38.865Z", "dateReserved": "2025-12-16T13:20:01.928Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-09T06:34:53.334Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder", "vendor": "wpmudev", "versions": [{"lessThanOrEqual": "1.49.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information."}, {"lang": "es", "value": "El plugin Forminator Forms \u2013 Contact Form, Payment Form &amp; Custom Form Builder para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 1.49.1, inclusive, a trav\u00e9s de la funci\u00f3n 'listen_for_csv_export'. Esto se debe a que el plugin no verifica correctamente que un usuario est\u00e1 autorizado para realizar una acci\u00f3n. Esto hace posible que atacantes autenticados, con acceso al panel de control de Forminator, exporten datos sensibles de env\u00edo de formularios, incluyendo informaci\u00f3n de identificaci\u00f3n personal."}], "id": "CVE-2025-14782", "lastModified": "2026-06-17T08:36:33.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14782", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T18:21:23.163240Z", "version": "2.0.3"}}]}, "published": "2026-01-09T07:16:01.537", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T21:41:44.040762+00:00", "value": {"mitigation_remediation": ["Check the vendor website for a patch or security update that addresses the CSV export authorization bypass.", "If an upgrade cannot be performed immediately, deny the listen_for_csv_export capability to all but trusted administrators using a role\u2011management plugin or custom code.", "As a temporary protection, remove or disable the export feature via a custom snippet that hooks into the export function or by disabling the export option in the plugin settings."], "summary": {"action": "Patch", "impact": "Confidentiality breach via unauthorized CSV export"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin developed by WpMudev. All releases numbered 1.49.1 and earlier are susceptible. Any WordPress site that uses the plugin and grants dashboard access to users is at risk; updating to any version above 1.49.1 removes the flaw.", "description_and_impact": "The Forminator Forms plugin for WordPress has an authorization bypass in all versions up to 1.49.1 through the listen_for_csv_export function. The plugin does not verify that the requesting user can export data, so any authenticated user who can access the Forminator dashboard can download CSV files containing sensitive form submissions, including personally identifiable information. This missing\u2011authorization flaw (CWE\u2011862) results in a confidentiality compromise of the data collected by the plugin.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity and the EPSS value of less than 1\u202f% suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and no public exploit has been disclosed. The attacker must first authenticate to the WordPress site and have dashboard access; once those conditions are satisfied, the CSV export can be invoked without additional privileges, allowing large volumes of data to be exfiltrated."}}}}, "created": "2026-01-09T13:23:55.965309+00:00", "updated": "2026-04-27T21:45:14.534803+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpmudev", "wpmudev$PRODUCT$forminator_forms"]}