CVE-2026-5192

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires a publicly accessible form with a File Upload field where Save and Continue is enabled in that form's Behavior settings and the Save and Continue email notification is configured to attach uploaded files in Email Notifications.

• CWE-22

• https://plugins.trac.wordpress.org/changeset/3500671/forminator
• https://www.wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=cve

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5186A weakness has been identified in Nothings stb up to 2.30. T…5.3
• CVE-2026-5187Two potential heap out-of-bounds write locations existed in …9.8
• CVE-2026-5188An integer underflow issue exists in wolfSSL when parsing th…8.1
• CVE-2026-5189CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Rep…9.2
• CVE-2026-5190Out-of-bounds write in the streaming decoder component in aw…7.7
• CVE-2026-5191The Tiled Gallery Carousel Without JetPack plugin for WordPr…5.4
• CVE-2026-51923An Insecure Direct Object Reference (IDOR) vulnerability exi…8.1
• CVE-2026-51924An issue in docuForm GmbH Client v.11.11c allows a remote at…8.1
• CVE-2026-51925A Local File Inclusion (LFI) vulnerability exists in docuFor…8.1
• CVE-2026-51926An issue in docuForm GmbH FSM Client v.11.11c allows a remot…7.5
• CVE-2026-5193The Essential Addons for Elementor – Popular Elementor Templ…6.5
• CVE-2026-51937An issue in Oneblog V2.3.9 allows a remote attacker to obtai…7.5