{
 "id": "WPSEC-2026-0622",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0622/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0622/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0622/index.md",
 "title": "Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms",
 "description": "The Forminator Forms plugin for WordPress is vulnerable to a CAPTCHA bypass in all versions up to, and including, 1.57.3.1. Submissions to any form containing a Stripe or PayPal field skipped CAPTCHA validation entirely. This makes it possible for unauthenticated attackers to submit such forms without solving the CAPTCHA the site owner configured, defeating its spam and abuse protection.",
 "plugin": {
  "slug": "forminator",
  "name": "Forminator Forms",
  "full_name": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/forminator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/forminator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/forminator"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.58.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.58.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.58.0",
 "remediation": "Update to 1.58.0 or later.",
 "fix_released": "2026-10-07T09:17:28+00:00",
 "published": "2026-10-08T09:45:16+00:00",
 "updated": "2026-10-07T11:47:08.397152+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0622/",
  "https://plugins.svn.wordpress.org/forminator/tags/1.58.0/",
  "https://wordpress.org/plugins/forminator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/forminator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-08"
 }
}