Form-Maker (twb_form-maker) < 1.15.22 - CSRF to limited RCE

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ‘execute’ function. This makes it possible for unauthenticated attackers to execute arbitrary methods in the ‘BoosterController’ class via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.