Now officially on WordPress.org

CVE Database / CVE-2025-14782

CVE · Medium

CVE-2025-14782 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.49.2

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-14782 Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.49.2 Missing Authorization Medium 5.3 < 1.49.2 1.49.2 2026-01-08 —

CVE-2025-14782

A security flaw in the Forminator Forms plugin allows unauthorized users to bypass authentication checks and gain access to sensitive form submission data, including personal details, via the 'listen_for_csv_export' function in versions up to 1.49.1. This occurs because the plugin fails to adequately verify user permissions before allowing certain actions. As a result, attackers with dashboard access can exploit this vulnerability to extract potentially sensitive information.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings