Summary

In this post, we will exploit the latest issue with the Forminator plugin where an unuathenticated attacker can steal HubSpot's CLIENT_SECRET and the HAPIKEY from the codebase, leading to an attacker making unauthorized changes to the developer's hubspot account or expose their PII.

general

Description