What is the CVSS score of CVE-2026-2729?

CVE-2026-2729 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Forminator Forms CVE-2026-2729

EUVD-2026-27223 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-05 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 07:31 vuln.today

DescriptionCVE.org

The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.

AnalysisAI

Forminator plugin for WordPress versions up to 1.52.0 allows unauthenticated attackers to bypass payment authorization by reusing previously succeeded Stripe PaymentIntent identifiers, enabling submission of high-value paid forms at no cost or reduced cost through payment bypass. The vulnerability affects the public payment processing flow where the plugin fails to verify that the attacker owns or is authorized to use a supplied PaymentIntent, making it possible to complete forms without proper payment validation.

Technical ContextAI

The Forminator plugin integrates with Stripe's payment processing API through PaymentIntent objects, which are used in Stripe's Payment Element and other modern payment flows. PaymentIntent identifiers (pi_*) are used to track payment status and retrieve transaction details. The vulnerability stems from insufficient authorization checks in the public payment form submission handler - the plugin appears to accept PaymentIntent IDs supplied by the client-side form without cryptographic verification that the current user initiated that specific payment intent. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: attackers can manipulate or reuse identifiers that the application trusts without re-validating ownership. An attacker can observe a successful PaymentIntent from any completed transaction (either their own low-value test or captured from network traffic) and replay it against a different form submission to bypass the payment requirement entirely.

RemediationAI

Upgrade Forminator plugin to version 1.52.1 or later, which includes the authorization fix (confirmed by WordPress plugin repository changeset 3500669). For organizations unable to patch immediately, disable Stripe payment processing in Forminator forms until the update is applied; alternatively, restrict form access to authenticated users only via WordPress user roles, though this reduces form usability. The fix adds server-side verification to confirm that the PaymentIntent identifier supplied in the payment flow matches the payment intent created during the current form submission session, preventing reuse across different form submissions. Verify the patch application by confirming the plugin version in WordPress admin and testing payment flows with invalid PaymentIntent identifiers to ensure they are rejected. No workarounds fully eliminate the risk without disabling payment functionality.