Draft form creation via missing nonce validation

CSRF in Forminator 1.35.1 and earlier allows remote attackers to create draft custom forms by inducing an administrator request. The custom-form create_module function performs state-changing form creation without correct WordPress nonce validation, so it accepts a forged request in the administrator's authenticated session. Exploitation requires a site administrator to interact with attacker-controlled content; the demonstrated consequence is limited to creation of a draft form.