PT-2026-1754 · WordPress · Forminator Forms

Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14782

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to and including 1.49.1

Description The Forminator Forms plugin is susceptible to authorization bypass. This occurs because the plugin does not adequately verify user authorization before allowing certain actions. An authenticated attacker with access to the Forminator dashboard can exploit this to export sensitive form submission data, potentially including personally identifiable information, through the listen for csv export function.

Recommendations Versions prior to and including 1.49.1 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14782

Affected Products

Forminator Forms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14782 · Security Note
• https://t.me/cveNotify/148186 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve · Note
• https://twitter.com/CVEnew/status/2009526574811382051 · Twitter Post