Forminator Forms CVE-2026-6214

Exploitation requires (1) valid WordPress subscriber-level or higher authentication credentials-either obtained through legitimate account creation if registration is enabled, or through compromised accounts; (2) the Forminator Forms plugin version 1.53.0 or earlier to be installed and active on the WordPress site; (3) access to the plugin's export configuration interface, which is reachable via the standard WordPress admin panel at /wp-admin or equivalent. No non-default configuration is required-standard Forminator Forms installations with default settings are vulnerable. Exploitation is limited to authenticated users only (CVSS PR:L confirms this), meaning unauthenticated external attackers cannot exploit this directly. However, any WordPress site with subscriber account creation enabled, guest registration for newsletters, or other mechanisms that distribute low-privilege accounts represents an exploitation avenue. Sites with strictly restricted user creation and no subscriber accounts are not vulnerable.

This vulnerability presents moderate-to-high real-world risk despite a CVSS score of 6.5. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects that network-accessible exploitation requires low privilege (subscriber-level authentication) with no user interaction needed, and impacts confidentiality severely. The low privilege requirement is the critical differentiator: WordPress installations typically have many subscriber accounts (newsletter subscribers, form submitters, etc.), significantly expanding the attack surface beyond admin-only vulnerabilities. The confidentiality impact (C:H) is justified-attackers gain access to configure data exfiltration pipelines targeting all form submissions. The lack of integrity or availability impact (I:N/A:N) is appropriate since scheduled exports do not modify or delete data. Exploitation probability is high given the straightforward authorization bypass requiring only valid subscriber credentials, no complex exploitation steps, and the plugin's widespread use. The authorization bypass nature makes this exploitable against default configurations of any Forminator Forms installation with subscriber accounts enabled. No KEV listing or public exploit code availability was provided in input data, so this remains outside confirmed active exploitation at analysis time, but the attack simplicity and low barrier to entry suggest rapid weaponization is probable if not already occurring in targeted attacks.

An attacker creates a free WordPress user account on a target website running Forminator Forms (typically possible if user registration is enabled or if the site accepts newsletter subscribers). Using subscriber-level credentials, the attacker navigates to the form export configuration interface and configures a new scheduled export job set to email all form submissions to attacker@example.com on a recurring basis. Because the listen_for_saving_export_schedule() function lacks authorization verification, the configuration is saved successfully. Subsequent form submissions from legitimate website visitors are automatically forwarded to the attacker's email address, exfiltrating contact information, payment details, or other sensitive data depending on form fields.