CVE-2026-111597 | BDVDB-2026-404772 Detail

Forminator Forms

Description#

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References#

https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/

Exploit#

https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/

History#

Version 12026-11-11Record published in the CVE List.