CVE-2024-7389

Name of the Vulnerable Software and Affected Versions Forminator plugin for WordPress versions up to, and including, 1.29.1

Description The issue allows unauthenticated attackers to extract the HubSpot integration developer API key, making unauthorized changes to the plugin's HubSpot integration possible. This can also lead to the exposure of personally identifiable information from plugin users using the HubSpot integration. The vulnerability is related to the class-forminator-addon-hubspot-wp-api.php file.

Recommendations For versions up to, and including, 1.29.1: Patch immediately and rotate any exposed credentials. As a temporary workaround, consider restricting access to the class-forminator-addon-hubspot-wp-api.php file until a patch is available.