PT-2026-36978 · WordPress · Forminator

Kittipat Jitphonchana · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-2729

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Forminator plugin for WordPress versions prior to 1.53.0

Description An authorization bypass exists because the plugin fails to properly verify user authorization when processing Stripe PaymentIntent identifiers in the public payment flow. This allows unauthenticated attackers to submit high-value paid forms as completed by reusing a previously successful low-value Stripe PaymentIntent, leading to payment bypass or underpayment.

Recommendations Update the plugin to a version later than 1.52.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-2729

Affected Products

Forminator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-2729 · Security Note
• https://twitter.com/CVEnew/status/2051595418946175329 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051596902785773724 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3500669/forminator · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1afb94ab-b3ba-4598-8ff4-f9ffc6717371?source=cve · Note