Forminator Forms CVE-2026-97638

Exploitation requires the attacker to already possess a valid victim draft_id, which the description says may be harvested from a shared 'continue later' resume link - this is the principal limiting factor, since draft_ids are not described as arbitrarily enumerable. The vulnerable path is the 'previous_draft_id' parameter in Forminator's custom-form submission handling, which performs no ownership/validation check on this user-controlled key (CWE-639). The nonce that nominally protects the request is not a barrier because any unauthenticated visitor can obtain it simply by loading a form page. The deployment must use Forminator ≤1.57.3.1 with the save-and-continue-later/draft feature in use. No authentication is required (PR:N), but the draft_id prerequisite means this is not blind, fully arbitrary exploitation against any installation.

The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) frames this as a remote, unauthenticated, low-complexity integrity flaw, and PR:N is consistent with the description's statement that unauthenticated attackers can act. However, the NVD AC:L contrasts with the description's own precondition that the attacker must first obtain a victim's draft_id (typically harvested from a shared 'continue later' link) - that dependency is a condition largely outside the attacker's control, which in my independent assessment raises real-world complexity to AC:H and lowers the effective score to ~5.9. The 'nonce check' is not a mitigating control here because, per the description, the nonce is publicly obtainable by any unauthenticated visitor loading a form page. No EPSS score, CISA KEV listing, or confirmed proof-of-concept is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only priority signal is the vuln.today 'this_week' label and the Wordfence report. Net: this is a genuine authorization (IDOR) weakness worth patching on a near-term schedule, but the requirement to possess a valid victim draft_id meaningfully gates mass exploitation, making it less urgent than the headline 7.5 'unauthenticated network' framing alone would suggest.

An attacker obtains a victim's draft_id - for example from a 'continue later' resume link the victim shared or that leaked - then loads any Forminator form page to grab the publicly available nonce. Supplying that draft_id in the 'previous_draft_id' parameter of a form submission, the unauthenticated attacker deletes the victim's saved draft and overwrites that identifier with attacker-controlled data. No proof-of-concept exploit code is identified in the available sources.