CVE-2026-111579: Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable
The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Formsto a version that resolves this vulnerability.Fixed in 1.58.4
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Forminator Forms versions before 1.58.4 are exposed if they have a payment-gated User Registration form whose configured gateway was connected previously and later became disconnected or unavailable. The risk is highest where that form assigns a privileged role, including administrator.
What does an attacker need to exploit it?
An attacker only needs to be an unauthenticated visitor able to submit the affected registration form while its configured payment gateway is unavailable. No payment is required because payment enforcement is missing on the server side in this condition.
Are default Forminator Forms installations affected?
The available information identifies a specific configuration requirement rather than a default installation condition: a payment-gated User Registration form and an unavailable gateway that had previously been connected. Installations without such a form are not described as affected.
What can be done if updating immediately is not possible?
Disable affected payment-gated User Registration forms, or ensure they cannot assign privileged roles, until Forminator Forms can be updated to version 1.58.4 or later. Restoring and maintaining availability of the configured payment gateway also removes the stated unavailable-gateway condition.
How can administrators determine whether exploitation may have occurred?
Review accounts created through payment-gated Forminator User Registration forms during periods when the configured payment gateway was disconnected or unavailable. Pay particular attention to newly created accounts assigned elevated roles, especially administrator.