This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-2729 | BDVDB-2026-330421 Detail

wpmudevForminator Forms – Contact Form, Payment Form & Custom Form Builder

Description#

The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.

Impact#

Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-639 Authorization Bypass Through User-Controlled Key

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.