EUVD-2026-59922
GHSA-cpvm-7qmf-33mv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible IDOR with no auth or user interaction; confidentiality impact limited to draft PII with no integrity or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and Continue' feature enabled.
AnalysisAI
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to and including 1.55.0.2) exposes other users' saved draft form submissions - including names, email addresses, phone numbers, postal addresses, and free-form message content - to any remote attacker who can iterate integer values on the 'draft' parameter. The root cause is CWE-639: the plugin retrieves draft records by a user-supplied integer key without validating that the requesting session owns the referenced entry. Exploitation is constrained to forms where the 'Save and Continue' feature is explicitly enabled; no public exploit has been identified at time of analysis, and a fix commit is referenced in the WordPress plugin repository.
Technical ContextAI
Forminator Forms is a WordPress plugin developed by WPMU Dev (CPE: cpe:2.3:a:wpmudev:forminator_forms_-_contact_form,_payment_form_&_custom_form_builder:*:*:*:*:*:*:*:*) offering contact, payment, and custom form building functionality. The 'Save and Continue' feature stores incomplete form submissions as draft entries with sequentially assigned integer IDs. The vulnerability resides in two code paths: the form rendering logic in class-render-form.php (lines 2000 and 2011) and the entry retrieval logic in class-form-entry-model.php (lines 160 and 212), as confirmed by Wordfence and corroborated by WordPress plugin repository source references for both tags 1.55.0 and 1.52.2. CWE-639 (Authorization Through User-Controlled Key) describes the root cause precisely: the application uses a developer-controlled primary key that is also user-controllable without enforcing ownership checks, allowing horizontal privilege escalation across user records. Because IDs are sequential integers, an attacker requires no knowledge of other users' sessions or tokens - simple incrementing enumeration suffices.
RemediationAI
Update the Forminator Forms plugin to a version beyond 1.55.0.2; a fix commit is referenced in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3593819%40forminator&new=3593819%40forminator, though the exact patched release version is not independently confirmed from the data available. If immediate patching is not feasible, the most effective compensating control is to disable the 'Save and Continue' feature on all active Forminator forms, as the vulnerability is only exploitable when this feature is enabled - disabling it eliminates the attack surface entirely with no impact on standard form submission functionality. Sites that require draft-saving for workflow reasons should consider restricting the affected endpoints via WAF rules targeting anomalous 'draft' parameter enumeration patterns (rapid sequential integer requests from a single IP) as a secondary measure, acknowledging that this is a rate-limiting mitigation rather than a fix. Monitor the Wordfence advisory at the URL above for confirmed patch version details.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today