Vulnerability in Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVE-2026-108486
MediumSeverity
0.2%Estimated exploit probability
600,000+ sitesInstalls
1.58.1Fixed in
What to do now
Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to 1.58.1 or later.
Affected versions
- Everything up to and including 1.58.0
Affected: Forminator Forms – Contact Form, Payment Form & Custom Form Builder (plugin, forminator)
What the vulnerability is
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.58.0. This is due to a missing capability check on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action.