Forminator Forms CVE-2026-2729

The vulnerability requires the target site to have Forminator plugin active with at least one form configured to accept Stripe payments. Exploitation requires the attacker to obtain a valid, previously succeeded Stripe PaymentIntent identifier - this can be captured passively via network inspection of any user's payment transaction on the target site, or an attacker can generate one by completing a low-value payment themselves. The form submission must include the Stripe PaymentIntent field exposed in the form HTML or JavaScript, and the plugin must be using Stripe's PaymentIntent-based payment method (standard in modern Forminator versions). No user interaction is required from the victim; the attacker can exploit this unilaterally. Limitation: The vulnerability is specific to forms integrated with Stripe - forms using other payment gateways or no payment processing are not affected.

CVSS score of 5.3 with AV:N/AC:L/PR:N/UI:N reflects moderate risk: network-accessible, no special attack complexity, unauthenticated, no user interaction required, but integrity impact only (no confidentiality or availability loss). However, real-world risk is significantly elevated beyond the CVSS score due to the business logic impact - this directly enables fraud through payment bypass on e-commerce and subscription forms. The vulnerability is trivial to exploit: an attacker needs only to capture a valid PaymentIntent identifier from any successful payment (via network inspection, shared test transactions, or form metadata) and reuse it. No POC status provided in input data, but the authorization bypass is straightforward enough that exploit code would require minimal effort. The lack of KEV designation is notable but does not reduce business risk - payment bypass vulnerabilities are typically targeted by fraud actors rather than mass exploit campaigns. WordPress plugin ecosystem reach is broad; any site using Forminator for paid forms (donations, subscriptions, event registration, e-commerce) is immediately vulnerable. For organizations processing payments through vulnerable Forminator instances, this represents high business impact despite moderate CVSS.

An attacker observes or creates a successful Stripe payment for a low-value form (e.g., $1 donation). They capture the PaymentIntent ID from browser network traffic or JavaScript console. They then navigate to a high-value form on the same or different website (e.g., $500 event registration) and submit the form, replacing the legitimately generated PaymentIntent with the captured one. The plugin processes the form as paid because it does not validate that the PaymentIntent was created for the current form submission, resulting in the attacker gaining access to premium content or services without payment.