CVE-2026-5192 Overview
CVE-2026-5192 is a path traversal vulnerability [CWE-22] in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.52.1. Unauthenticated attackers can exploit the upload-1[file][file_path] parameter to read arbitrary files on the underlying server. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled and the related email notification attaches uploaded files. Forminator is installed on hundreds of thousands of WordPress sites, expanding the potential attack surface.
Critical Impact
Unauthenticated remote attackers can read sensitive server files, including configuration files containing database credentials and API keys.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All versions up to and including 1.52.1
- WordPress sites with vulnerable forms exposing File Upload fields and Save and Continue notifications
Discovery Timeline
- 2026-05-05 - CVE-2026-5192 published to NVD
- 2026-05-05 - Last updated in NVD database
Technical Details for CVE-2026-5192
Vulnerability Analysis
The vulnerability resides in how Forminator processes the upload-1[file][file_path] parameter during form submission. The plugin accepts a user-controlled file path without sufficient validation or canonicalization. An attacker can supply traversal sequences such as ../ to escape the intended upload directory and reference arbitrary files on the host filesystem.
When Save and Continue is enabled and the corresponding email notification is configured to attach uploaded files, the plugin reads the attacker-supplied path and attaches the resulting file to the outbound email. The attacker receives the file contents through this notification channel. This results in unauthenticated information disclosure across the entire web server file system accessible to the WordPress process.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin trusts the file_path value submitted with the upload payload and does not enforce that the resolved path remains within the designated uploads directory. Path normalization and allowlist checks are absent before the file is read and attached to the notification email.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. The attacker locates a public-facing form that meets three preconditions: the form contains a File Upload field, Save and Continue is enabled in the form Behavior settings, and the Save and Continue email notification is configured to attach uploaded files. The attacker submits crafted form data with a traversal payload in the upload-1[file][file_path] parameter. The targeted file is then delivered to an attacker-controlled email address as an attachment. Because no verified public proof-of-concept is published, refer to the Wordfence Vulnerability Report for technical context.
Detection Methods for CVE-2026-5192
Indicators of Compromise
- POST requests to Forminator submission endpoints containing ../ or URL-encoded traversal sequences (%2e%2e%2f) in the upload-1[file][file_path] parameter.
- Outbound emails generated by the WordPress host with attachments referencing system paths such as /etc/passwd, wp-config.php, or .env.
- Web server access logs showing repeated form submissions from a single IP address with anomalous file_path values.
Detection Strategies
- Inspect WordPress request bodies for traversal patterns targeting upload-1[file][file_path] and related Forminator parameters.
- Correlate suspicious form submissions with mail server logs to identify notifications attaching files outside wp-content/uploads/.
- Audit installed plugin versions across the WordPress estate and flag Forminator builds at or below 1.52.1.
Monitoring Recommendations
- Enable verbose logging on the WordPress reverse proxy or WAF and alert on directory traversal signatures.
- Monitor outbound SMTP traffic for unusual attachment names or sizes originating from form notification workflows.
- Track file system access on wp-config.php, /etc/passwd, and other sensitive paths from the PHP-FPM or web server process.
How to Mitigate CVE-2026-5192
Immediate Actions Required
- Update the Forminator plugin to a version newer than 1.52.1 that includes the fix from WordPress Plugin Update changeset 3500671.
- Disable the Forminator plugin on any site where an immediate update is not feasible.
- Audit existing forms and disable Save and Continue email attachments until patches are applied.
Patch Information
The vendor addressed the issue in the changeset published at plugins.trac.wordpress.org changeset 3500671. Administrators should upgrade to the latest Forminator release available through the WordPress plugin repository. Verify the installed version reads above 1.52.1 after the update.
Workarounds
- Remove File Upload fields from publicly accessible Forminator forms until the plugin is updated.
- Disable the Save and Continue feature in form Behavior settings to break the exploitation precondition.
- Reconfigure email notifications so uploaded files are not attached to outbound messages.
- Deploy a web application firewall rule that blocks traversal sequences in the upload-1[file][file_path] parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
