The vulnerability is an Insecure Direct Object Reference caused by missing validation on the 'previous_draft_id' parameter, allowing unauthenticated users to delete any saved draft belonging to another user and overwrite that draft identifier with attacker‑controlled form submissions. This can lead to loss of data integrity and potential impersonation of form submissions. The weakness is classified as CWE-639.

WordPress installations running the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin, versions up to and including 1.57.3.1, as identified by the vendor wpmudev:Forminator Forms – Contact Form, Payment Form & Custom Form Builder. No other products are noted as affected.

The CVSS score of 7.5 indicates moderate to high severity. No EPSS score is available, so the probability of exploitation is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires the attacker to know a victim's draft_id, which can be harvested from a shared "continue later" link; the nonce check is effectively bypassed because it can be obtained by any unauthenticated visitor loading the form page. Once the draft_id is known, the attacker can craft a request to delete and overwrite the draft, thereby compromising the integrity of stored form data.