Forminator Forms vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 1.58.0Fixed in 1.58.0Published 29 October 2026CVE-2026-97638

   Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the...

2. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.2 (high)no login neededAffected: older than 1.58.0Fixed in 1.58.0Published 10 October 2026CVE-2026-96341

   Advisory: Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

3. Deletion

   Someone could delete content or files, which can take the store down.

   Score 7.5 (high)no login neededAffected: older than 1.58.0Fixed in 1.58.0Published 10 October 2026CVE-2026-65459

   Advisory: Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

4. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 1.58.0Fixed in 1.58.0Published 10 October 2026CVE-2026-102388

   Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

5. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 7.5 (high)no login neededAffected: older than 1.57.2.1Fixed in 1.57.2.1Published 9 October 2026CVE-2026-96336

   Advisory: Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

6. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 1.57.3Fixed in 1.57.3Published 7 October 2026CVE-2026-96335

   Advisory: Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.

7. Cross-site request forgery

   Someone could trick a logged-in admin into making a change.

   Score 7.1 (high)no login neededAffected: older than 1.58.0Fixed in 1.58.0Published 2 October 2026CVE-2026-106611

   Advisory: Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

8. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 1.57.2.1Fixed in 1.57.2.1Published 30 September 2026CVE-2026-85235

   Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due...

9. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 1.57.2.1Fixed in 1.57.2.1Published 30 September 2026CVE-2026-92144

   Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including,...

10. Code execution

    Someone could run their own code on your server.

    Score 8.5 (high)needs only a customer accountAffected: older than 1.57.2.1Fixed in 1.57.2.1Published 18 September 2026CVE-2026-87067

    Advisory: The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management...

11. Missing permission check

    An action that should need permission could be done without it.

    Score 9.1 (critical)no login neededAffected: older than 1.57.3Fixed in 1.57.3Published 28 August 2026CVE-2026-92229

    Advisory: The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2.

12. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 1.57.0.3Fixed in 1.57.0.3Published 24 August 2026CVE-2026-18323

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and...

13. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 1.57.0.1Fixed in 1.57.0.1Published 24 August 2026CVE-2026-18328

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and...

14. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 1.57.0.2Fixed in 1.57.0.2Published 24 August 2026CVE-2026-18324

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1...

15. PHP object injection

    In some setups, someone could make your server run code.

    Score 9.8 (critical)no login neededAffected: older than 1.57.1Fixed in 1.57.1Published 20 August 2026CVE-2026-66583

    Advisory: Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

16. File upload

    Someone could upload files to your server, which can include code.

    Score 9.8 (critical)no login neededAffected: older than 1.56.2Fixed in 1.56.2Published 18 August 2026CVE-2026-15748

    Advisory: The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function.

17. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.2 (high)no login neededAffected: older than 1.56.2Fixed in 1.56.2Published 5 August 2026CVE-2026-18325

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and...

18. Privilege escalation

    A user could give themselves more rights, up to full admin.

    Score 8.8 (high)needs only a customer accountAffected: older than 1.56.0.1Fixed in 1.56.0.1Published 3 August 2026CVE-2026-28111

    Advisory: Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

19. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.56.1Fixed in 1.56.1Published 3 August 2026CVE-2026-28143

    Advisory: Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

20. File access

    Someone could read files on your server they should never see.

    Score 7.5 (high)no login neededAffected: older than 1.55.1Fixed in 1.55.1Published 8 July 2026CVE-2026-57815

    Advisory: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator:...

21. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.55.0.2Fixed in 1.55.0.2Published 8 July 2026CVE-2026-57814

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects...

22. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.53.2Fixed in 1.53.2Published 24 June 2026CVE-2026-56071

    Advisory: Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

23. File access

    Someone could read files on your server they should never see.

    Score 7.5 (high)no login neededAffected: older than 1.52.2Fixed in 1.52.2Published 4 May 2026CVE-2026-5192

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter.

24. Deletion

    Someone could delete content or files, which can take the store down.

    Score 8.8 (high)no login neededAffected: older than 1.44.3Fixed in 1.44.3Published 1 July 2025CVE-2025-6463

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files'...

25. PHP object injection

    In some setups, someone could make your server run code.

    Score 8.8 (high)no login neededAffected: older than 1.44.3Fixed in 1.44.3Published 1 July 2025CVE-2025-6464

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input...

26. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)needs only a customer accountAffected: older than 1.36.0Fixed in 1.36.0Published 25 October 2024CVE-2024-10402

    Advisory: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including,...

27. Data exposure

    Information meant to stay private could be read.

    Score 7.5 (high)no login neededAffected: older than 1.29.2Fixed in 1.29.2Published 1 August 2024CVE-2024-7389

    Advisory: The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php.

28. Cross-site scripting

    Someone could plant a script that runs in your visitors' or your admins' browsers.

    Score 7.1 (high)no login neededAffected: older than 1.29.1Fixed in 1.29.1Published 25 March 2024CVE-2024-29777

    Advisory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator.This issue affects Forminator: from n/a...

29. File upload

    Someone could upload files to your server, which can include code.

    Score 9.8 (critical)no login neededAffected: older than 1.25.0Fixed in 1.25.0Published 29 August 2023CVE-2023-4596

    Advisory: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to,...

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find Forminator Forms. The version number is under its name. If it is lower than 1.58.0, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/forminator/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update Forminator Forms to 1.58.0 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use Forminator Forms.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use Forminator Forms, delete it instead of leaving it deactivated.

Questions

Which Forminator Forms version fixes it?

Version 1.58.0 or newer fixes all 29 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs Forminator Forms older than 1.58.0. In WordPress, open Plugins and read the version under Forminator Forms. Without logging in, open yourstore.com/wp-content/plugins/forminator/readme.txt and read the Stable tag line.

I don't use Forminator Forms any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 5 November 2026.