Forminator Forms CVE-2026-12998

Exploitation requires that at least one Forminator form on the target WordPress site has the 'Save and Continue' feature explicitly enabled - this is not a default configuration for all form types and must be deliberately turned on by a site administrator. No authentication is required (CVSS PR:N confirmed), no user interaction is needed, and attack complexity is low (CVSS AC:L). The 'draft' parameter must be supplied with integer values in HTTP requests to the affected endpoint; sequential enumeration starting from any observed ID is sufficient. Exploitation is limited to reading draft data only - there is no write, modify, or delete capability confirmed, and submitted (finalized) form entries are not exposed through this vector. Forms without 'Save and Continue' enabled are not exploitable regardless of plugin version.

The CVSS 3.1 score of 5.3 (Medium) reflects the network-accessible, unauthenticated, zero-complexity attack vector paired with limited confidentiality impact and no integrity or availability consequence - an accurate characterization for a scoped IDOR. Real-world risk is meaningfully bounded by the prerequisite that the 'Save and Continue' feature must be enabled on a form; sites not using this feature are entirely unaffected regardless of plugin version. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Despite the bounded CVSS score, the practical data-exposure impact is significant for any deployment collecting PII via forms with drafts enabled - even a mid-sized municipal IT team in gliwice managing a WordPress installation that uses Forminator's draft-save capability for citizen intake forms would face real privacy and regulatory risk if PII were enumerated at scale. The absence of POC code and the non-default nature of the 'Save and Continue' feature lower operational urgency somewhat, but the trivial exploitation mechanics (sequential integer iteration, no auth) mean that once an attacker identifies a vulnerable target, data collection is straightforward and fully automatable.

An attacker identifies a WordPress site running Forminator Forms with the 'Save and Continue' feature enabled on a public-facing form. The attacker submits a partial form entry to obtain a baseline draft ID, then iterates the 'draft' parameter value sequentially upward in unauthenticated HTTP requests, receiving the PII-containing draft submissions of other users in each response. Because IDs are sequential integers and no authentication or token is required, the enumeration can be fully scripted, potentially harvesting hundreds of records in minutes.