Description
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled in that form's Behavior settings and the Save and Continue email notification is configured to attach uploaded files in Email Notifications.
Published: 2026-05-05
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to send a crafted file path via the upload-1[file][file_path] parameter. When a form has the Save and Continue feature enabled and email notifications are set to attach uploaded files, the plugin can expose the contents of any file that the web server process can read. This results in unauthorized disclosure of sensitive data without granting code execution or modifying system integrity.

Affected Systems

WordPress sites running Forminator Forms plugin version 1.52.1 or earlier are affected. Any site with a publicly reachable form that includes a File Upload field, has the Save and Continue option enabled, and the email notification configured to attach uploaded files is vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates a high confidentiality risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is straightforward and requires no authentication, making it likely that an exposed site can be exploited by anyone who can submit a form.

Generated by OpenCVE AI on May 5, 2026 at 08:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Forminator Forms to the latest version (at least 1.52.2).
  • Disable the File Upload field or the Save and Continue feature on all publicly accessible forms until a patched version is in place.
  • Configure web application firewall or server rules to block requests containing traversal patterns such as '..' or '../../../' in the upload-1[file][file_path] parameter, and monitor for such attempts.

Generated by OpenCVE AI on May 5, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 05 May 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Wpmudev
Wpmudev forminator Forms – Contact Form, Payment Form & Custom Form Builder
Vendors & Products Wordpress
Wordpress wordpress
Wpmudev
Wpmudev forminator Forms – Contact Form, Payment Form & Custom Form Builder

Tue, 05 May 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled in that form's Behavior settings and the Save and Continue email notification is configured to attach uploaded files in Email Notifications.
Title Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Wordpress Wordpress
Wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-05T06:43:30.712Z

Reserved: 2026-03-30T21:05:06.011Z

Link: CVE-2026-5192

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-05T07:16:00.643

Modified: 2026-05-05T07:16:00.643

Link: CVE-2026-5192

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-05T08:30:20Z

Weaknesses