Lucene search

WordfenceVULNRICHMENT:CVE-2024-7389

HistoryAug 02, 2024 - 4:29 a.m.

CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

2024-08-0204:29:55

CWE-522

Wordfence

github.com

wordpress

forminator

sensitive information exposure

hubspot integration

api key

unauthorized access

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

26.5%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin’s HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

CNA Affected

[
  {
    "vendor": "wpmudev",
    "product": "Forminator – Contact Form, Payment Form & Custom Form Builder",
    "versions": [
      {
        "status": "affected",
        "version": "*",
        "versionType": "semver",
        "lessThanOrEqual": "1.29.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:incsub:forminator:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "incsub",
    "product": "forminator",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "semver",
        "lessThanOrEqual": "1.29.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

developers.hubspot.com/docs/api/webhooks#manage-settings-via-api

developers.hubspot.com/docs/api/webhooks#scopes

plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php

www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

26.5%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-7389