CVE-2026-111597 · Package
NO FIX YET · SEE WHAT TO DO
The Forminator Forms WordPress plugin before 1.58.4 does not check that a Stripe Checkout payment has completed before returning the after-payment response for a pending form submission. An unauthenticated visitor can get the post-payment redirect URL and thank-you message of a payment-gated form without paying.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Forminator Forms WordPress plugin before 1.58.4 that take payment through Stripe Checkout in a form. The flaw exposes the post-payment redirect and thank-you message, so sites with forms that do not take payment are unlikely to be affected. unknown whether sites without Stripe payments are exposed.
Not affected if forminator-1.58.4-or-later, no-stripe-payment-forms
Who cares forminator, stripe, wordpress
wp plugin get forminator --field=version1.58.4 or laterThe Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.