CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

What is CVE-2024-7389?

CVE-2024-7389 is a high-severity vulnerability in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder, published on 2 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.

Weakness: CWE-522

Which versions are affected by CVE-2024-7389?

It affects 1 product.

Products include Incsub Forminator.

How do I fix CVE-2024-7389?

No fix has been published for CVE-2024-7389 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-7389 being exploited?

There is no known exploitation of CVE-2024-7389 in the wild and no public exploit code.

Other vulnerabilities in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

• CVE-2023-4596 Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2025-6463 Path traversal in Forminator Forms – Contact Form, Payment Form & Custom Form Builder High 8.8
• CVE-2025-6464 Deserialization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder High 7.5
• CVE-2024-31077 SQL injection in Forminator High 7.2
• CVE-2024-1794 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q46j-26g9-j9w4.