Lucene search

WordfenceCVE-2024-7389

HistoryAug 02, 2024 - 5:15 a.m.

CVE-2024-7389

2024-08-0205:15:51

CWE-522

Wordfence

web.nvd.nist.gov

forminator

wordpress

sensitive information exposure

hubspot integration

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin’s HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

Affected configurations

Vulners

Vulnrichment

Node

wpmudevcustom_sidebarsRange≤1.29.1wordpress

VendorProductVersionCPE
wpmudevcustom_sidebars*cpe:2.3:a:wpmudev:custom_sidebars:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpmudev	custom_sidebars	*	cpe:2.3:a:wpmudev:custom_sidebars::::::wordpress::*

CNA Affected

[
  {
    "vendor": "wpmudev",
    "product": "Forminator – Contact Form, Payment Form & Custom Form Builder",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.29.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

developers.hubspot.com/docs/api/webhooks#manage-settings-via-api

developers.hubspot.com/docs/api/webhooks#scopes

plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php

www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

26.5%

JSON

Related for CVE-2024-7389