PT-2026-1754 · WordPress · Forminator Forms

CVE-2025-14782 · Publicado 2026-01-09 · Atualizado 2026-01-09

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to and including 1.49.1

Description The Forminator Forms plugin is susceptible to authorization bypass. This occurs because the plugin does not adequately verify user authorization before allowing certain actions. An authenticated attacker with access to the Forminator dashboard can exploit this to export sensitive form submission data, potentially including personally identifiable information, through the listen for csv export function.

Recommendations Versions prior to and including 1.49.1 should be updated.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14782

Produtos afetados

Forminator Forms

Referências · 5

• https://t.me/cveNotify/148186 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14782 · Nota de Segurança
• https://twitter.com/CVEnew/status/2009526574811382051 · Publicação no Twitter