https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:36:19 +0000 https://db.gcve.eu/vuln/cve-2026-12998 <p><strong>Affected:</strong> wpmudev Forminator Forms – Contact Form, Payment Form &amp; Custom Form Builder</p> <p>The Forminator Forms – Contact Form, Payment Form &amp; Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the &#39;draft&#39; parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the &#39;draft&#39; parameter and read other users&#39; saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the &#39;Save and Continue&#39; feature enabled.</p> <p><strong>Affected:</strong> wpmudev Forminator Forms – Contact Form, Payment Form &amp; Custom Form Builder</p> <p>The Forminator Forms – Contact Form, Payment Form &amp; Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the &#39;draft&#39; parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the &#39;draft&#39; parameter and read other users&#39; saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the &#39;Save and Continue&#39; feature enabled.</p> https://db.gcve.eu/vuln/cve-2026-12998