{"id":"CVE-2026-111579","kind":"vulnerability","aliases":["CVE-2026-111579"],"related":[],"title":"Forminator WordPress plugin: unpaid registration grants admin role to visitors","description":"The Forminator Forms  WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected.","summary":"The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server when a form's payment gateway is disconnected. An unauthenticated visitor can finish a payment-gated User Registration form for free and be given the form's configured role, up to administrator.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Forminator Forms","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["forminator","package","wordpress","wordpress-plugin"],"not_affected_if":["forminator-1.58.4-or-later","no-payment-gateway","no-user-registration-forms"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list, or with `wp plugin get forminator --field=version`.\n- Look for User Registration forms that set a role above subscriber, and check whether a payment gateway was connected and later disconnected.","fix":"- Forminator: move to `1.58.4` or later.","status":"open","published_at":"2026-11-11T06:17:11+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:55+00:00","updated_at":"2026-11-11T06:27:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T06:27:55Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator: move to `1.58.4` or later.","reach":"internet","title":"Forminator WordPress plugin: unpaid registration grants admin role to visitors","impact":"high","summary":"The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server when a form's payment gateway is disconnected. An unauthenticated visitor can finish a payment-gated User Registration form for free and be given the form's configured role, up to administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","forminator","wordpress-plugin"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Anyone can register an account with administrator rights on the site.","analyst_note":"","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list, or with `wp plugin get forminator --field=version`.\n- Look for User Registration forms that set a role above subscriber, and check whether a payment gateway was connected and later disconnected.","plain_action":"","product_name":"Forminator Forms","needs_analyst":false,"not_affected_if":["forminator-1.58.4-or-later","no-payment-gateway","no-user-registration-forms"],"who_is_affected":"Sites running the Forminator Forms plugin before 1.58.4 that use a payment-gated User Registration form with a configured role. The exposure needs a payment gateway that was connected and then disconnected, so sites that never took payments through Forminator are less likely to be affected. unknown whether sites on other plugin versions or hosts are affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4562,"output_tokens":601,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111579':13A,16A '-2026':12A,15A '1.58.4':31B,78C 'admin':7A 'administr':71B,120C 'allow':96C 'assign':112C 'complet':100C 'configur':67B,91C,116C 'connect':126C 'cve':11A,14A 'disconnect':46B,129C 'enforc':34B,81C 'finish':51B 'form':27B,41B,58B,65B,74C,89C,107C,114C 'formin':1A,19B,26B,73C 'forminator':17A 'forms':18A 'free':60B 'gate':55B,104C 'gateway':44B,93C,123C 'given':63B 'grant':6A 'later':128C 'packag':20B 'pay':109C 'payment':35B,43B,54B,82C,92C,103C 'payment-g':53B,102C 'plugin':3A,24B,29B,76C 'registr':5A,57B,106C 'role':8A,68B,117C 'server':38B,85C 'side':86C 'unauthent':48B,97C 'unavail':95C 'unpaid':4A 'user':56B,105C 'visitor':10A,49B,98C 'without':108C 'wordpress':2A,21B,23B,28B,75C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator Forms plugin before 1.58.4 that use a payment-gated User Registration form with a configured role. The exposure needs a payment gateway that was connected and then disconnected, so sites that never took payments through Forminator are less likely to be affected. unknown whether sites on other plugin versions or hosts are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["forminatorforms","forms"],"ptokens":["forminator","forms"],"labels":["forminator","high","package","vendor","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-111579':13A,16A '-2026':12A,15A 'admin':7A 'cve':11A,14A 'formin':1A 'forminator':17A 'forms':18A 'grant':6A 'plugin':3A 'registr':5A 'role':8A 'unpaid':4A 'visitor':10A 'wordpress':2A","search_b":"'1.58.4':31B 'administr':71B 'configur':67B 'disconnect':46B 'enforc':34B 'finish':51B 'form':27B,41B,58B,65B 'formin':19B,26B 'free':60B 'gate':55B 'gateway':44B 'given':63B 'packag':20B 'payment':35B,43B,54B 'payment-g':53B 'plugin':24B,29B 'registr':57B 'role':68B 'server':38B 'unauthent':48B 'user':56B 'visitor':49B 'wordpress':21B,23B,28B 'wordpress-plugin':22B","search_c":"'1.58.4':78C 'administr':120C 'allow':96C 'assign':112C 'complet':100C 'configur':91C,116C 'connect':126C 'disconnect':129C 'enforc':81C 'form':74C,89C,107C,114C 'formin':73C 'gate':104C 'gateway':93C,123C 'later':128C 'pay':109C 'payment':82C,92C,103C 'payment-g':102C 'plugin':76C 'registr':106C 'role':117C 'server':85C 'side':86C 'unauthent':97C 'unavail':95C 'user':105C 'visitor':98C 'without':108C 'wordpress':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111579","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111579","severity":null,"published_at":"2026-11-11T06:17:11+00:00","modified_at":"2026-11-11T06:17:11+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}