{"id":"CVE-2026-111597","kind":"vulnerability","aliases":["CVE-2026-111597"],"related":[],"title":"Forminator Forms WordPress plugin: unpaid users see post-payment content","description":"The Forminator Forms  WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.","summary":"The Forminator Forms WordPress plugin before 1.58.4 does not check that a Stripe Checkout payment has completed before returning the after-payment response for a pending form submission. An unauthenticated visitor can get the post-payment redirect URL and thank-you message of a payment-gated form without paying.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","package","stripe","wordpress"],"not_affected_if":["forminator-1.58.4-or-later","no-stripe-payment-forms"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list, or with `wp plugin get forminator --field=version`\n- Look for payment-gated forms that use Stripe Checkout","fix":"- Forminator Forms (WordPress plugin): `1.58.4` or later","status":"open","published_at":"2026-11-11T06:17:11+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","triaged_at":"2026-11-11T06:27:53+00:00","updated_at":"2026-11-11T06:27:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:53Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator Forms (WordPress plugin): `1.58.4` or later","reach":"internet","title":"Forminator Forms WordPress plugin: unpaid users see post-payment content","impact":"low","summary":"The Forminator Forms WordPress plugin before 1.58.4 does not check that a Stripe Checkout payment has completed before returning the after-payment response for a pending form submission. An unauthenticated visitor can get the post-payment redirect URL and thank-you message of a payment-gated form without paying.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","forminator","stripe"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unpaid visitors access post-payment content of paid forms","analyst_note":"","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list, or with `wp plugin get forminator --field=version`\n- Look for payment-gated forms that use Stripe Checkout","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-stripe-payment-forms","forminator-1.58.4-or-later"],"who_is_affected":"Sites running the Forminator Forms WordPress plugin before 1.58.4 that take payment through Stripe Checkout in a form. The flaw exposes the post-payment redirect and thank-you message, so sites with forms that do not take payment are unlikely to be affected. unknown whether sites without Stripe payments are exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4553,"output_tokens":558,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-111597':14A,17A '-2026':13A,16A '1.58.4':28B,81C 'after-pay':42B,98C 'allow':102C 'check':31B 'checkout':35B,88C 'complet':38B,91C 'content':11A 'cve':12A,15A 'form':2A,24B,49B,72B,77C,123C 'formin':1A,18B,23B,76C 'gate':71B,122C 'get':55B 'messag':66B,117C 'obtain':106C 'packag':19B 'pay':74B,125C 'payment':10A,36B,44B,59B,70B,89C,100C,110C,121C 'payment-g':69B,120C 'pend':48B,95C 'plugin':4A,26B,79C 'post':9A,58B,109C 'post-pay':8A,57B,108C 'redirect':60B,111C 'respons':45B,101C 'return':40B,93C 'see':7A 'stripe':20B,34B,87C 'submiss':50B,96C 'thank':64B,115C 'thank-you':63B,114C 'unauthent':52B,103C 'unpaid':5A 'url':61B,112C 'user':6A 'verifi':84C 'visitor':53B,104C 'without':73B,124C 'wordpress':3A,21B,25B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator Forms WordPress plugin before 1.58.4 that take payment through Stripe Checkout in a form. The flaw exposes the post-payment redirect and thank-you message, so sites with forms that do not take payment are unlikely to be affected. unknown whether sites without Stripe payments are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forminator","medium","package","stripe","wordpress"],"campaign_type":null,"search_a":"'-111597':14A,17A '-2026':13A,16A 'content':11A 'cve':12A,15A 'form':2A 'formin':1A 'payment':10A 'plugin':4A 'post':9A 'post-pay':8A 'see':7A 'unpaid':5A 'user':6A 'wordpress':3A","search_b":"'1.58.4':28B 'after-pay':42B 'check':31B 'checkout':35B 'complet':38B 'form':24B,49B,72B 'formin':18B,23B 'gate':71B 'get':55B 'messag':66B 'packag':19B 'pay':74B 'payment':36B,44B,59B,70B 'payment-g':69B 'pend':48B 'plugin':26B 'post':58B 'post-pay':57B 'redirect':60B 'respons':45B 'return':40B 'stripe':20B,34B 'submiss':50B 'thank':64B 'thank-you':63B 'unauthent':52B 'url':61B 'visitor':53B 'without':73B 'wordpress':21B,25B","search_c":"'1.58.4':81C 'after-pay':98C 'allow':102C 'checkout':88C 'complet':91C 'form':77C,123C 'formin':76C 'gate':122C 'messag':117C 'obtain':106C 'pay':125C 'payment':89C,100C,110C,121C 'payment-g':120C 'pend':95C 'plugin':79C 'post':109C 'post-pay':108C 'redirect':111C 'respons':101C 'return':93C 'stripe':87C 'submiss':96C 'thank':115C 'thank-you':114C 'unauthent':103C 'url':112C 'verifi':84C 'visitor':104C 'without':124C 'wordpress':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111597","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111597","severity":null,"published_at":"2026-11-11T06:17:11+00:00","modified_at":"2026-11-11T06:17:11+00:00","first_seen_at":"2026-11-11T06:25:40+00:00","fetched_at":"2026-11-11T06:25:40+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}