# Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files

- **ID:** WPSEC-2026-0822
- **Plugin:** Forminator Forms – Contact Form, Payment Form & Custom Form Builder (`forminator`), https://wordpress.org/plugins/forminator/
- **Affected versions:** all versions before 1.58.1
- **Fixed in:** 1.58.1 (Update to 1.58.1 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/forminator
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0822/

## Description

The Forminator Forms plugin for WordPress is vulnerable to Sensitive Information Exposure via scheduled entry exports in all versions up to, and including, 1.58.0. This is due to export CSV files being written to the publicly accessible wp-content/uploads/forminator/ directory under a predictable name (the form name slug plus a timestamp), and to exports that were skipped because there were no new submissions, or that were queued for several recipients, not being deleted afterwards. This makes it possible for unauthenticated attackers to guess the file URL and download form submission data when scheduled exports are enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0822/
- https://plugins.svn.wordpress.org/forminator/tags/1.58.1/
- https://wordpress.org/plugins/forminator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0822/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.