Forminator Forms: Unauthenticated disclosure of post-payment content
Summary
The Forminator Forms WordPress plugin does not verify that a Stripe Checkout payment has completed before returning the after-payment response of a pending submission. Unauthenticated visitors can therefore obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying. The attack requires no account and little complexity; the impact depends on what the post-payment pages contain.
Affected
- Forminator Forms 1.58.0 to 1.58.3 (before 1.58.4)
- Forms with Stripe Checkout payment enabled
Fixed in
- Forminator Forms 1.58.4
- Fix status for this CVE is not confirmed by the vendor changelog, which does not name the CVE.
Workaround
- Unknown. No vendor-specific workaround was found; upgrading is the remedy.
- Interim measure (not from sources): temporarily disable paid Forminator forms whose post-payment pages contain sensitive content.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Public exploit code is not confirmed; the WPScan reference is tagged 'exploit' and its content could not be checked.
Our recommendation
- Update Forminator Forms to version 1.58.4 or later in the normal update cycle, without long delay.
- Check whether paid forms expose download links or member-only content on post-payment pages.
- Until patched, consider temporarily disabling paid forms with sensitive post-payment content.
- Review the same update, which also covers related issue CVE-2026-111579.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-111597 www.cve.org
- Strix AI CVE-2026-111597 www.strix.ai
- Forminator on WordPress.org wordpress.org
- WPMU DEV roadmap wpmudev.com
- OffSeq Radar CVE-2026-111597 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:08.
Original description (NVD)
The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.