Insecure Direct Object Reference in Forminator Forms for WordPress
CVE-2026-97638
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 October 2026
What is CVE-2026-97638?
The Forminator Forms plugin for WordPress is susceptible to an Insecure Direct Object Reference through the 'previous_draft_id' parameter in all versions up to 1.57.3.1. This vulnerability arises from inadequate validation of a user-controlled key, enabling unauthenticated attackers to delete saved drafts belonging to other users. By exploiting this flaw, attackers can overwrite draft identifiers with malicious submissions after harvesting a target's draft_id via a shared 'continue later' link. The nonce check, intended to add a layer of security, is easily bypassed since it is publicly accessible to any unauthenticated user loading the form page.
Affected Version(s)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder 0 <= 1.57.3.1