{"id":"CVE-2026-97638","aliases":["EUVD-2026-114220","GHSA-j4f8-pmw5-f47j"],"status":"published","title":"Forminator Forms \u003c= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter","description":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00561,"percentile":0.46977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-10-30T17:15:27Z","modified":"2026-10-30T19:20:27Z","products":[{"vendor":"wpmudev","product":"forminator forms – contact form, payment form \u0026 custom form builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L3110"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L429"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L1685"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L3662"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L196"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3732192%40forminator%2Ftags%2F1.57.3.1\u0026old=3700727%40forminator%2Ftags%2F1.57.3"},{"url":"https://plugins.trac.wordpress.org/changeset/3732209/forminator/trunk/library/modules/custom-forms/front/front-action.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97638"},{"url":"https://github.com/advisories/GHSA-j4f8-pmw5-f47j"}],"sources":{"cve":[{"id":"CVE-2026-97638","title":"Forminator Forms \u003c= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter","description":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","status":"published","published":"2026-10-30T17:15:27.922Z","modified":"2026-10-30T18:08:58.688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-114220","description":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","status":"published","published":"2026-10-30T17:15:27Z","modified":"2026-10-30T18:08:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-j4f8-pmw5-f47j","title":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is...","description":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","status":"published","published":"2026-10-30T18:32:46Z","modified":"2026-10-30T18:32:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:14:52.01816Z"}],"nvd":[{"id":"CVE-2026-97638","description":"The Forminator Forms – Contact Form, Payment Form \u0026 Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","status":"published","published":"2026-10-30T18:18:21.47Z","modified":"2026-10-30T19:20:27.05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:13:05.268617Z"}]}}