vulnerability

WordPress Plugin: forminator: CVE-2023-2010: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

Jun 12, 2023

Added

May 15, 2025

Modified

Apr 30, 2026

Description

The Forminator plugin for WordPress is vulnerable to a race condition in versions up to, and including, 1.23.3. This is due to improper validation on the poll voting functionality. This makes it possible for unauthenticated attackers to make multiple votes on a poll.

Solution

forminator-plugin-cve-2023-2010

References

https://www.cve.org/CVERecord?id=CVE-2023-2010
https://www.wordfence.com/threat-intel/vulnerabilities/id/a40cb2da-dc13-4e20-9602-a4e6c2eade43?source=api-prod
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33540
CVE-2023-2010
https://attackerkb.com/topics/CVE-2023-2010
CWE-362
EUVD-EUVD-2023-33540

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report