Unauthorized Access to HubSpot Integration API Key via class-forminator-addon-hubspot-wp-api.php

CVE-2024-7389

Summary

The Forminator plugin for WordPress has a vulnerability that allows unauthorized access to sensitive information, specifically exposing the HubSpot integration developer API key. This issue exists in all versions up to and including 1.29.1, through the file class-forminator-addon-hubspot-wp-api.php. Attackers can exploit this weakness to gain unauthorized control over the plugin's HubSpot integration, leading to potential exposure of personally identifiable information from users interacting with the plugin. Organizations using the Forminator plugin need to apply updates and review their security practices to mitigate the risks associated with this vulnerability.

References