CVE-2026-6214
Deferred Deferred - Pending Action

Missing Authorization in Forminator WordPress Plugin

Publication date: 2026-05-07

Last updated on: 2026-05-07

Assigner: Wordfence

Description
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listen_for_csv_export() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-07
Last Modified
2026-05-07
Generated
2026-07-06
AI Q&A
2026-05-07
EPSS Evaluated
2026-07-05
NVD
CVE-2026-6214
EUVD
EUVD-2026-28308

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforms forminator_forms to 1.53.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Impact Analysis

This vulnerability can lead to sensitive data exfiltration by unauthorized users. Attackers with low-level access can configure the plugin to email all form submissions to themselves.

As a result, confidential or personal information collected via forms can be leaked, potentially causing privacy breaches and data loss.

Executive Summary

The vulnerability exists in the Forminator Forms plugin for WordPress, specifically in versions up to and including 1.53.0. It is caused by the listen_for_saving_export_schedule() function failing to check user permissions before saving scheduled export configurations.

Because of this missing authorization check, authenticated users with only subscriber-level access can configure scheduled export jobs that send all form submissions to an attacker-controlled email address.

This flaw allows attackers to exfiltrate sensitive data submitted through forms without proper authorization.

Compliance Impact

This vulnerability allows authenticated attackers with subscriber-level access to configure scheduled export jobs that email all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.

Such unauthorized disclosure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information to prevent unauthorized access and data breaches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6214. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart