Forminator Forms CVE-2026-5192

Exploitation requires four specific preconditions to be met simultaneously: (1) a publicly accessible Forminator form must exist on the WordPress site, (2) the form must include a File Upload field configured by the administrator, (3) the 'Save and Continue' feature must be explicitly enabled in that form's Behavior settings (non-default configuration), and (4) Email Notifications for that form must be configured to attach uploaded files. These are NOT default settings - administrators must intentionally configure all four elements. Limiting factors that reduce real-world exposure: many Forminator forms use only text fields without file upload, Save and Continue is an optional feature primarily used for multi-step forms, and email attachment of uploaded files is a specific notification setting that many deployments omit. Installations using Forminator purely for basic contact forms without file upload capability are not vulnerable. The vulnerability does not require authentication (PR:N) or user interaction (UI:N), but the narrow configuration requirements mean the actual vulnerable surface is a subset of all Forminator installations.

Real-world risk is MODERATE despite the High (7.5) CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-based unauthenticated exploitation with low complexity, which normally suggests critical priority. However, multiple specific preconditions significantly limit attack surface: administrators must have created a publicly accessible form, enabled the File Upload field, activated the Save and Continue feature in Behavior settings, and configured email notifications to attach uploaded files - this is NOT a default configuration. EPSS data not provided, preventing exploitation probability assessment. No CISA KEV listing indicates this is not being actively exploited in widespread campaigns. Patch available via Trac changeset 3500671 provides quick remediation path. The high impact (C:H) is real - arbitrary file read can expose wp-config.php with database credentials, .htaccess files, or user data - but the narrow exploitation conditions mean only a subset of Forminator installations are vulnerable. Priority should be HIGH for sites with public forms using these specific features, MEDIUM for general Forminator installations where the configuration can be verified as safe.

An unauthenticated attacker identifies a WordPress site running vulnerable Forminator Forms with a publicly accessible contact form that has file upload enabled and Save and Continue configured. The attacker crafts a malicious HTTP request manipulating the 'upload-1[file][file_path]' parameter with path traversal sequences like '../../../wp-config.php' to read the WordPress configuration file containing database credentials, authentication keys, and salts. The attacker retrieves sensitive configuration data through the file attachment mechanism in the email notification system, then uses the exposed database credentials to access the backend database and extract user information or escalate privileges. No public proof-of-concept code identified, but the vulnerability is straightforward to exploit given the specific configuration conditions.