What is the CVSS score of CVE-2026-6214?

CVE-2026-6214 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Forminator Forms CVE-2026-6214

EUVD-2026-28308 MEDIUM

Missing Authorization (CWE-862)

2026-05-07 Wordfence

GHSA-v9xc-5wqq-j4p4

Authentication Bypass PHP Information Disclosure WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 04:47 vuln.today

CVE Published

May 07, 2026 - 03:27 nvd

MEDIUM 6.5

DescriptionCVE.org

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listen_for_csv_export() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.

AnalysisAI

Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.

Technical ContextAI

The vulnerability stems from missing capability checks in the Forminator Forms WordPress plugin's export functionality, specifically in the listen_for_saving_export_schedule() function located in library/class-export.php. WordPress plugins use capability checks (such as current_user_can() with 'manage_options' or plugin-specific capabilities) to enforce authorization. The plugin correctly implements this check in listen_for_csv_export() but failed to apply the same control to the scheduled export configuration handler. This is classified as CWE-862 (Missing Authorization), where user-supplied actions are executed without verifying the user possesses the necessary permissions. The affected CPE indicates all versions of the Forminator Forms plugin up to and including 1.53.0 contain this flaw.

RemediationAI

Update Forminator Forms plugin to version 1.53.1 or later, which includes authorization checks in the listen_for_saving_export_schedule() function matching the implementation in listen_for_csv_export(). Install the patched version via WordPress admin dashboard (Plugins → Updates → Update Forminator Forms) or manually upload the patched plugin files from the official WordPress plugin repository. Verify the fix by navigating to the scheduled export configuration interface and confirming that non-admin users receive a 'You do not have permission to do this' error or equivalent authorization failure. As an interim mitigation pending plugin update, restrict subscriber account creation to trusted users only, and audit existing subscriber accounts for suspicious activity (check exported form data destinations via WordPress admin logs if available). Disable the export functionality entirely via plugin settings if scheduled exports are not required for your use case, though this requires manual review of plugin code or contact with the plugin vendor for feature toggles. Monitor database records for export_schedule post meta entries created by low-privilege users, which would indicate exploitation attempts.