What the vulnerability does
01Description
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with access to the Forminator dashboard, to export sensitive form submission data including personally identifiable information.
Explanation of Vulnerability in Simple Terms
02Summary
Forminator Forms contains an authorization flaw that allows authenticated users with low privileges to read sensitive data they should not access. The vulnerability requires network access and some attack complexity, but does not require user interaction. No integrity or availability impact occurs. Update to a version newer than 1.49.1.
What an attacker can do
03Attacker Capabilities
Read sensitive data from the form builder that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Authenticated users can access confidential form data, settings, or submissions beyond their intended permission level.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account on the WordPress site.
Key dates
06Disclosure timeline
January 9, 2026
CVE published
April 8, 2026
Record updated
