PT-2026-36981 · WordPress · Forminator Forms

Daroo · Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-5192

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.52.2

Description A Path Traversal issue exists in the Forminator Forms plugin for WordPress. Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information, by manipulating the upload-1[file][file path] parameter. This exploitation is possible if a publicly accessible form has a File Upload field with the Save and Continue feature enabled in the Behavior settings, and the corresponding email notification is configured to attach uploaded files.

Recommendations Update the plugin to a version later than 1.52.1. As a temporary mitigation, disable the Save and Continue feature in the Behavior settings of forms containing File Upload fields or disable the attachment of uploaded files in Email Notifications.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-5192

Affected Products

Forminator Forms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5192 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=cve · Note
• https://twitter.com/CVEnew/status/2051595418149237044 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3500671/forminator · Note
• https://t.me/CVEtracker/52721 · Telegram Post
• https://twitter.com/infoflowcloud/status/2051596886289637842 · Twitter Post