CVE-2026-6214: Forminator Forms Auth Bypass Vulnerability

CVE-2026-6214 Overview

CVE-2026-6214 is a missing authorization vulnerability in the Forminator Forms plugin for WordPress, affecting all versions up to and including 1.53.0. The flaw resides in the listen_for_saving_export_schedule() function within library/class-export.php, which fails to perform a capability check before saving scheduled export configurations. Authenticated attackers with subscriber-level access can configure a scheduled export job that emails all form submissions to an attacker-controlled address. This results in exfiltration of sensitive data collected through any Forminator form on the site, including personally identifiable information (PII) submitted by site visitors.

Critical Impact

Subscriber-level users can hijack scheduled exports to silently exfiltrate every form submission to an external email address, exposing PII and confidential business data.

Affected Products

• Forminator Forms plugin for WordPress, versions up to and including 1.53.0
• WordPress sites with subscriber-level or higher user registration enabled
• Sites collecting form submissions through Forminator (contact, quiz, poll, payment forms)

Discovery Timeline

• 2026-05-07 - CVE-2026-6214 published to NVD
• 2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-6214

Vulnerability Analysis

The vulnerability is classified as Missing Authorization [CWE-862]. Forminator exposes two parallel handler functions for export operations. The listen_for_csv_export() function correctly verifies user permissions before processing requests. The sibling listen_for_saving_export_schedule() function in library/class-export.php omits this capability check entirely.

When a request to save a scheduled export reaches this handler, the plugin processes the supplied configuration without validating whether the requester has administrative privileges. An authenticated user with the lowest WordPress role, subscriber, can submit the request and persist a malicious export schedule.

The scheduled job runs on the site's normal cron cycle and emails the contents of all form submissions to whatever recipient address the attacker configured. Because the abuse uses a legitimate plugin feature, no malware or modified PHP files are introduced, making the activity blend with normal administrative operations.

Root Cause

The root cause is an inconsistent authorization model between two related handlers. Developers added a capability check to the CSV export entry point but did not propagate the same current_user_can() guard to the schedule-saving entry point. The fix added in subsequent releases introduces the missing capability check before the schedule is persisted. See the WordPress Forminator Changeset Update for the corrective patch.

Attack Vector

Exploitation requires only a valid WordPress account with subscriber-level access, which is trivially obtained on sites with open registration. The attacker sends a crafted POST request to the vulnerable handler with parameters defining the export schedule, including the destination email and form selection. Once saved, the WordPress cron triggers the export job and dispatches all form submission data to the attacker's mailbox without further interaction.

Detailed source references are available in the WordPress Forminator Export Class and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-6214

Indicators of Compromise

• Unexpected entries in the Forminator scheduled export configuration referencing external email addresses not belonging to site administrators.
• Outbound emails generated by the WordPress mailer containing form submission archives addressed to unfamiliar recipients.
• Recent subscriber-level account registrations followed by POST requests targeting Forminator admin-ajax or admin-post endpoints.
• WordPress option table entries related to forminator_export_schedule modified by non-administrator user IDs.

Detection Strategies

• Audit the Forminator plugin settings for any scheduled exports and validate the recipient address against a known administrator list.
• Review web server access logs for POST requests to Forminator export endpoints originating from low-privilege session cookies.
• Correlate WordPress user activity logs with changes to plugin options to identify privilege mismatches.
• Monitor outbound SMTP traffic for attachments named after Forminator export patterns sent to non-corporate domains.

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture option updates and plugin configuration changes with the responsible user ID.
• Forward WordPress and web server logs to a centralized analytics platform to detect anomalous low-privilege user behavior.
• Alert on creation of new scheduled tasks within the WordPress cron system that reference Forminator export hooks.
• Track outbound email volume from the WordPress host and flag attachments containing structured form data.

How to Mitigate CVE-2026-6214

Immediate Actions Required

• Update the Forminator Forms plugin to a version later than 1.53.0 that includes the capability check fix.
• Inspect the Forminator export schedule configuration and remove any unauthorized entries pointing to external recipients.
• Disable open user registration or restrict the default role assigned to new accounts if registration is required.
• Rotate any credentials or sensitive values that may have been submitted through Forminator forms during the exposure window.

Patch Information

The vendor addressed the issue by adding the missing capability check to listen_for_saving_export_schedule(), aligning it with the protection already present in listen_for_csv_export(). Site administrators should upgrade Forminator to the patched release referenced in the WordPress Forminator Changeset Update. Confirm the installed version under WordPress Admin → Plugins after upgrade.

Workarounds

• Temporarily deactivate the Forminator Forms plugin until the patch can be applied if upgrade is not immediately possible.
• Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php for subscriber-level users via a web application firewall rule.
• Set the WordPress default_role option to a value below subscriber capability where feasible, or disable users_can_register entirely.
• Apply WAF signatures that block POST parameters associated with Forminator export schedule configuration from non-administrator sessions.

# Configuration example: disable open registration and verify plugin version
wp option update users_can_register 0
wp plugin get forminator --field=version
wp plugin update forminator