Vulnerability · Published May 5, 2026 · Assigned by Wordfence
CVE-2026-2729Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in Forminator Forms – Contact Form, Payment Form & Custom Form Builder from wpmudev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Official description
The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpmudev | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 0 – through 1.52.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N