CVE Database /
CVE-2026-5192
CVE · High
CVE-2026-5192 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.52.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-5192
|
Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.52.2 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
High
7.5
|
< 1.52.2
|
1.52.2 |
2026-05-04 |
—
|
CVE-2026-5192
The Forminator Forms plugin for WordPress contains a security flaw affecting versions up to 1.52.1, allowing unauthorized access to server files via an 'upload-1[file][file_path]' parameter. This vulnerability enables attackers to retrieve sensitive information from arbitrary files on the server, which can be accessed through a form with a File Upload field and specific notification settings enabled.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings