{
 "id": "WPSEC-2026-0822",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0822/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0822/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0822/index.md",
 "title": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files",
 "description": "The Forminator Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via scheduled entry exports in all versions up to, and including, 1.58.0. This is due to export CSV files being written to the publicly accessible wp-content/uploads/forminator/ directory under a predictable name (the form name slug plus a timestamp), and to exports that were skipped because there were no new submissions, or that were queued for several recipients, not being deleted afterwards. This makes it possible for unauthenticated attackers to guess the file URL and download form submission data when scheduled exports are enabled.",
 "plugin": {
  "slug": "forminator",
  "name": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
  "full_name": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/forminator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/forminator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/forminator"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.58.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.58.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.58.1",
 "remediation": "Update to 1.58.1 or later.",
 "fix_released": "2026-10-12T09:33:08+00:00",
 "published": "2026-10-13T12:45:11+00:00",
 "updated": "2026-10-13T12:12:38.144248+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0822/",
  "https://plugins.svn.wordpress.org/forminator/tags/1.58.1/",
  "https://wordpress.org/plugins/forminator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/forminator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-13"
 }
}