Forminator < 1.53.0.1 - Subscriber+ Scheduled Form Submissions Export

Description

The plugin is vulnerable to Missing Authorization due to the `listen_for_saving_export_schedule()` function in `library/class-export.php` failing to perform a capability check before saving the scheduled export configuration. This makes it possible for authenticated attackers with Subscriber-level access and above to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.