Forminator – Contact Form, Payment Form & Custom Form Builder, CVE-2026-2729
- CVE, Research URL
- Home page URL
-
Security reports for Forminator – Contact Form, Payment Form & Custom Form Builder
- Published on
- May 05, 2026
- Research Description
- The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.
- Affected versions
-
max 1.52.1.
- Status
-
vulnerable