What’s Vulnerable › Vulnerabilities

CVE-2024-7389: Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-02 · updated 2026-06-17
• Weakness: CWE-522

Description

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

Affected products

• WPMU DEV Forminator: before 1.29.2 — fixed in 1.29.2

How to fix

Upgrade to a fixed version: WPMU DEV Forminator 1.29.2. Check the vendor advisory for mitigations.

References

• https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api
• https://developers.hubspot.com/docs/api/webhooks#scopes
• https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve
• https://www.vicarius.io/vsociety/posts/source-code-dive-to-hunt-for-secrets-in-forminator-code-cve-2024-7389

Get alerted when CVE-2024-7389 or the next vulnerability affects your stack