CVE-2026-6214
Received Received - Intake
BaseFortify

Publication date: 2026-05-07

Last updated on: 2026-05-07

Assigner: Wordfence

Description
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listen_for_csv_export() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-07
Last Modified
2026-05-07
Generated
2026-05-07
AI Q&A
2026-05-07
EPSS Evaluated
N/A
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wpforms forminator_forms to 1.53.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :

This vulnerability can lead to sensitive data exfiltration by unauthorized users. Attackers with low-level access can configure the plugin to email all form submissions to themselves.

As a result, confidential or personal information collected via forms can be leaked, potentially causing privacy breaches and data loss.


Can you explain this vulnerability to me?

The vulnerability exists in the Forminator Forms plugin for WordPress, specifically in versions up to and including 1.53.0. It is caused by the listen_for_saving_export_schedule() function failing to check user permissions before saving scheduled export configurations.

Because of this missing authorization check, authenticated users with only subscriber-level access can configure scheduled export jobs that send all form submissions to an attacker-controlled email address.

This flaw allows attackers to exfiltrate sensitive data submitted through forms without proper authorization.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart