CVE-2026-6214: Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listenforsavingexportschedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listenforcsvexport() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6214?
CVE-2026-6214 is considered a high severity vulnerability due to the potential for unauthorized data access.
How do I fix CVE-2026-6214?
To fix CVE-2026-6214, update the Forminator Forms plugin to version 1.54.0 or later.
What are the implications of CVE-2026-6214?
The implications of CVE-2026-6214 include the risk of unauthorized users exporting sensitive form submission data.
Which versions of Forminator Forms are affected by CVE-2026-6214?
Forminator Forms versions up to and including 1.53.0 are affected by CVE-2026-6214.
Who is at risk from CVE-2026-6214?
Authenticated users with subscriber-level access or higher may exploit CVE-2026-6214 to export form submissions.