CVE-2026-12998
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Forminator Forms plugin for WordPress up to version 1.55.0.2 is vulnerable to Insecure Direct Object Reference via the 'draft' parameter. Unauthenticated attackers can enumerate sequential entry IDs and read other users' saved draft data, including names, emails, phone numbers, and message content, when the 'Save and Continue' feature is enabled.
Risk Assessment
Risk of privacy breach through exposure of personal data, potentially leading to identity theft or GDPR violations.
Recommendation
Update the Forminator Forms plugin to the latest version. Disable the 'Save and Continue' feature if not essential.
Original NVD description (English source)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and Continue' feature enabled.