CVE-2024-7389

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api	Related
https://developers.hubspot.com/docs/api/webhooks#scopes	Related
https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve	Third Party Advisory
https://www.vicarius.io/vsociety/posts/source-code-dive-to-hunt-for-secrets-in-forminator-code-cve-2024-7389	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:incsub:forminator:::::free:wordpress::
	cpe:2.3:a:incsub:forminator:::::pro:wordpress::

History

No history.

Information

Published : 2024-08-02 05:15

Updated : 2025-02-05 14:59

NVD link : CVE-2024-7389

Mitre link : CVE-2024-7389

CVE.ORG link : CVE-2024-7389

JSON object : View

Products Affected

incsub

forminator

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2024-7389", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-08-02T05:15:51.510", "references": [{"url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api", "tags": ["Related"], "source": "[email protected]"}, {"url": "https://developers.hubspot.com/docs/api/webhooks#scopes", "tags": ["Related"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://www.vicarius.io/vsociety/posts/source-code-dive-to-hunt-for-secrets-in-forminator-code-cve-2024-7389", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-522"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration."}, {"lang": "es", "value": " El complemento Forminator para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en todas las versiones hasta la 1.29.1 incluida a trav\u00e9s de class-forminator-addon-hubspot-wp-api.php. Esto hace posible que atacantes no autenticados extraigan la clave API del desarrollador de integraci\u00f3n de HubSpot y realicen cambios no autorizados en la integraci\u00f3n de HubSpot del complemento o expongan informaci\u00f3n de identificaci\u00f3n personal de los usuarios del complemento que utilizan la integraci\u00f3n de HubSpot."}], "lastModified": "2025-02-05T14:59:01.993", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:incsub:forminator:*:*:*:*:free:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "8F0D5A35-0E3D-4774-82CD-2C91E59470C9", "versionEndExcluding": "1.29.2"}, {"criteria": "cpe:2.3:a:incsub:forminator:*:*:*:*:pro:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "C9EB0ECB-1B39-40FF-A85E-17AB10FDE719", "versionEndExcluding": "1.29.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}