Contributor Privilege Escalation in Forminator Forms XML-RPC

Forminator did not check its own form-management permission when WordPress XML-RPC wp.newPost / wp.editPost calls targeted Forminator forms, quizzes or polls, and it accepted submissions to any form that was not a draft. A Contributor could therefore create a pending registration form over XML-RPC that grants the Administrator role, then submit it... Weiterlesen: Contributor Privilege Escalation in Forminator Forms XML-RPC