Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files
- ID
- WPSEC-2026-0822
- Plugin
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder (forminator)
- Affected
- all versions before 1.58.1
- Remediation
- Update to 1.58.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-13
- Attack surface
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Forminator Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via scheduled entry exports in all versions up to, and including, 1.58.0. This is due to export CSV files being written to the publicly accessible wp-content/uploads/forminator/ directory under a predictable name (the form name slug plus a timestamp), and to exports that were skipped because there were no new submissions, or that were queued for several recipients, not being deleted afterwards. This makes it possible for unauthenticated attackers to guess the file URL and download form submission data when scheduled exports are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0822/
- https://plugins.svn.wordpress.org/forminator/tags/1.58.1/
- https://wordpress.org/plugins/forminator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS