Live › vulnerability › CVE-2026-97638
Forminator, a WordPress form builder plugin, fails to check ownership of a draft ID, so an unauthenticated visitor can delete other people's saved drafts and overwrite them with their own submissions. An attacker needs a victim's draft ID, which can be taken from a shared 'continue later' link, and the nonce check does not stop this because any visitor can load it from a form page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 18:55 UTC. All times on this page are UTC.
Sites running the Forminator WordPress plugin version 1.57.3.1 or earlier that let visitors save and resume form drafts. Sites without Forminator, or with a newer version, are not covered by these sources. The sources do not say whether managed WordPress hosts are affected differently.
No product ranges from the sources yet.
1.57.3.1 are affectedprevious_draft_id parameter1.57.3.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.
This page as .md · .json · in your agent: get_signal("CVE-2026-97638")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.