WordPress Plugin Vulnerabilities

Forminator Forms < 1.57.2 - Unauthenticated Payment Bypass

Description

The plugin is vulnerable to Payment Bypass, making it possible for unauthenticated attackers to bypass payments.

Affects Plugins

Plugin icon
forminator
Fixed in 1.57.2

References

CVE
CVE-2026-82220
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/906e73a2-c05c-4a5e-b111-df3c1b05f8a5

Miscellaneous

Original Researcher
Ahmed Hassan
Verified
No
WPVDB ID
9605a7c4-0eee-4909-84c9-42237a745ac4

Timeline

Publicly Published
2026-08-28 (about 1 month ago)
Added
2026-09-02 (about 1 month ago)
Last Updated
2026-09-02 (about 1 month ago)

Other

Published
Title
Published
2026-09-16
Title
WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check
Published
2026-09-09
Title
Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
Published
2020-08-21
Title
Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues
Published
2026-10-12
Title
WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
Published
2024-07-08
Title
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) < 1.5.113 - IP Address Spoofing to Antispam Bypass