# Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms

- **ID:** WPSEC-2026-0622
- **Plugin:** Forminator Forms – Contact Form, Payment Form & Custom Form Builder (`forminator`), https://wordpress.org/plugins/forminator/
- **Affected versions:** all versions before 1.58.0
- **Fixed in:** 1.58.0 (Update to 1.58.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/forminator
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0622/

## Description

The Forminator Forms plugin for WordPress is vulnerable to a CAPTCHA bypass in all versions up to, and including, 1.57.3.1. Submissions to any form containing a Stripe or PayPal field skipped CAPTCHA validation entirely. This makes it possible for unauthenticated attackers to submit such forms without solving the CAPTCHA the site owner configured, defeating its spam and abuse protection.

## References

- https://wpsec.com/vuln/WPSEC-2026-0622/
- https://plugins.svn.wordpress.org/forminator/tags/1.58.0/
- https://wordpress.org/plugins/forminator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0622/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.