Forminator Forms vulnerabilities
We track 3 vulnerabilities in Forminator Forms products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Forminator Forms vulnerabilities
- 8.1 High severity
Forminator Forms: Improper Privilege Management
The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be
- 8.5 High severity
Forminator Forms: Improper Control of Generation of Code
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and
- 7.2 High severity
Forminator Forms: Improper Control of Generation of Code
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.