CVE-2026-2729

The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This makes it possible for unauthenticated attackers to submit high-value paid forms as completed by reusing a previously succeeded low-value Stripe PaymentIntent, resulting in underpayment/payment bypass conditions.

• CWE-639

• https://plugins.trac.wordpress.org/changeset/3500669/forminator
• https://www.wordfence.com/threat-intel/vulnerabilities/id/1afb94ab-b3ba-4598-8ff4-f9ffc6717371?source=cve

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27284InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…7.8
• CVE-2026-27285InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…5.5
• CVE-2026-27286InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…5.5
• CVE-2026-27287InCopy versions 20.5.2, 21.2 and earlier are affected by an …7.8
• CVE-2026-27288Adobe Experience Manager versions 6.5.24, FP11.7 and earlier…5.4
• CVE-2026-27289Photoshop Desktop versions 27.4 and earlier are affected by …7.8
• CVE-2026-27290Adobe Framemaker versions 2022.8 and earlier are affected by…8.6
• CVE-2026-27291InDesign Desktop versions 20.5.2, 21.2 and earlier are affec…7.8
• CVE-2026-27292Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
• CVE-2026-27293Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
• CVE-2026-27294Adobe Framemaker versions 2022.8 and earlier are affected by…7.8
• CVE-2026-27295Adobe Framemaker versions 2022.8 and earlier are affected by…7.8