CVE-2025-14782

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export

View on CVE.org

Published Jan 9, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information.

Analysis

Technical impact

The Forminator Forms plugin for WordPress has an authorization bypass in all versions up to 1.49.1 through the listen_for_csv_export function. The plugin does not verify that the requesting user can export data, so any authenticated user who can access the Forminator dashboard can download CSV files containing sensitive form submissions, including personally identifiable information. This missing‑authorization flaw (CWE‑862) results in a confidentiality compromise of the data collected by the plugin.

Affected Systems

The vulnerability affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin developed by WpMudev. All releases numbered 1.49.1 and earlier are susceptible. Any WordPress site that uses the plugin and grants dashboard access to users is at risk; updating to any version above 1.49.1 removes the flaw.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity and the EPSS value of less than 1 % suggests a low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog, and no public exploit has been disclosed. The attacker must first authenticate to the WordPress site and have dashboard access; once those conditions are satisfied, the CSV export can be invoked without additional privileges, allowing large volumes of data to be exfiltrated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

wpmudev

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.49.1

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—
Wpmudev	Forminator Forms	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check the vendor website for a patch or security update that addresses the CSV export authorization bypass.
If an upgrade cannot be performed immediately, deny the listen_for_csv_export capability to all but trusted administrators using a role‑management plugin or custom code.
As a temporary protection, remove or disable the export feature via a custom snippet that hooks into the export function or by disabling the export option in the plugin settings.

Generated by OpenCVE AI on April 27, 2026 at 21:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.291% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve

History

Jan 9, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 9, 2026 1:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Wpmudev Wpmudev forminator Forms
Vendors & Products		Wordpress Wordpress wordpress Wpmudev Wpmudev forminator Forms

Jan 9, 2026 6:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information.
Title		Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/changeset/3423003/forminator/trunk/library/class-export.php https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=cve
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}`