Input validation vulnerability in Forminator – Contact Form, Payment Form & Custom Form Builder 1.13.5

The Forminator plugin for WordPress has a security vulnerability in versions up to 1.13.4 that allows unauthenticated attackers to export form submissions. This is because the plugin does not have proper validation for a function called listen_for_saving_export_schedule(). This means attackers can send a fake request and get an administrator to do something like click a link, and the form submissions can be exported.