What is the CVSS score of CVE-2026-5192?

CVE-2026-5192 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Forminator Forms are affected by CVE-2026-5192?

CVE-2026-5192 is a path traversal vulnerability in the Forminator Forms WordPress plugin that allows unauthenticated attackers to read arbitrary files from affected servers, including database…

How to fix or mitigate CVE-2026-5192?

Within 24 hours: Audit all WordPress instances for Forminator plugin presence and identify forms with file upload fields and 'Save and Continue' enabled; disable affected forms if possible. Within 7 days: Implement network-level access controls to restrict form endpoints, apply Web Application Firewall (WAF) rules to block path traversal patterns (../, ..\), and monitor form submission logs for suspicious file access attempts. Within 30 days: Contact Forminator vendor for patch timeline; if unavailable, evaluate plugin replacement or disable Forminator entirely until patch is released.

Forminator Forms CVE-2026-5192

EUVD-2026-27229 HIGH

Path Traversal (CWE-22)

2026-05-05 Wordfence

GHSA-gchw-m9mp-vv65

WordPress Path Traversal File Upload Wordpress Plugin Forminator Forms Contact Form Payment Form Custom Form Builder Wpmudev

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 07:30 vuln.today

DescriptionCVE.org

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled in that form's Behavior settings and the Save and Continue email notification is configured to attach uploaded files in Email Notifications.

AnalysisAI

Path Traversal in Forminator Forms plugin allows unauthenticated remote attackers to read arbitrary files from WordPress servers, potentially exposing database credentials, configuration files, and sensitive user data. Exploitation requires a publicly accessible form with File Upload field and specific 'Save and Continue' behavior settings enabled. CVSS 7.5 (High) with network vector and no authentication required. No CISA KEV listing or public exploit identified at time of analysis, suggesting limited active exploitation despite high theoretical severity.

Technical ContextAI

This vulnerability affects the Forminator Forms plugin (WPMUDEV) for WordPress versions up to and including 1.52.1, identified by CPE cpe:2.3:a:wpmudev:forminator_forms. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The vulnerability exists in the file upload handling mechanism where the 'upload-1[file][file_path]' parameter is not properly sanitized. When the Save and Continue feature is enabled with email notifications configured to attach uploaded files, attackers can manipulate the file path parameter to traverse outside the intended upload directory. This allows reading arbitrary files from the web server's filesystem, bypassing access controls that should restrict file access to the web root or designated upload directories. Path Traversal attacks typically use sequences like '../' to navigate up directory structures.

RemediationAI

Update Forminator Forms plugin to version 1.52.2 or later immediately, available through the WordPress admin dashboard or directly from the WordPress plugin repository. The fix is documented in Trac changeset 3500671 at https://plugins.trac.wordpress.org/changeset/3500671/forminator. For installations that cannot immediately patch, implement these specific compensating controls: disable the 'Save and Continue' feature in Behavior settings for all forms with File Upload fields, or remove the file attachment option from email notifications in those forms. Alternative mitigation is to make forms with file upload private (require authentication) rather than publicly accessible. Note that disabling Save and Continue may impact user experience for multi-step forms, and removing file attachments from notifications may disrupt workflows that depend on receiving uploaded files via email. Additional defense-in-depth: implement web application firewall (WAF) rules to detect path traversal patterns in upload parameters, though this may generate false positives and requires careful tuning. Full vendor advisory available at https://www.wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=cve.