CVE-2026-111597: Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session
The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the WPMU DEV Forminator Forms WordPress plugin with Stripe Checkout payment-gated forms are exposed if they run a version before 1.58.4. The affected form must return an after-payment redirect URL or thank-you message that should only be available after successful payment.
What does an attacker need to exploit it?
An attacker does not need to authenticate or complete payment. They need to interact with a payment-gated form's Stripe Checkout flow and obtain the response for a pending, unpaid submission.
Is payment completion required to access the protected post-payment content?
No. Affected versions do not verify that the Stripe Checkout payment completed before returning the pending submission's after-payment response.
What should be done if upgrading is not immediately possible?
The provided information does not identify a workaround. Until the plugin is updated, avoid placing sensitive information in post-payment redirect URLs or thank-you messages for Stripe Checkout forms.
How can an administrator determine whether they are affected?
Check whether Forminator Forms is installed at a version before 1.58.4 and whether Stripe Checkout payment-gated forms are in use. Test only in an authorized environment whether an unpaid pending checkout session returns the form's post-payment redirect URL or thank-you message.