{"id":"CVE-2026-97638","aliases":[],"cve":{"records":[{"id":"CVE-2026-97638","source":"Wordfence","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-24T17:22:34.939Z","published":"2026-10-30T17:15:27.922Z","modified":"2026-10-30T18:08:58.688Z"}],"publishers":[{"name":"Wordfence","role":"CNA","organizationId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","modified":"2026-10-30T17:15:27.922Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T18:08:58.688Z"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=cve","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L3110","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L429","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L1685","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L3662","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L196","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3732192%40forminator%2Ftags%2F1.57.3.1&old=3700727%40forminator%2Ftags%2F1.57.3","tags":[],"source":"Wordfence"},{"url":"https://plugins.trac.wordpress.org/changeset/3732209/forminator/trunk/library/modules/custom-forms/front/front-action.php","tags":[],"source":"Wordfence"}],"weaknesses":[{"id":"CWE-639","description":"CWE-639 Authorization Bypass Through User-Controlled Key","source":"Wordfence"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:34:15.270358Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter","titleSource":"Wordfence","descriptionSource":"Wordfence","description":"The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared \"continue later\" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page.","score":7.5,"severity":"high","published":"2026-10-30T17:15:27.922Z","modified":"2026-10-30T18:08:58.688Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"wpmudev","name":"Forminator Forms – Contact Form, Payment Form & Custom Form Builder","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.57.3.1","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"Wordfence","url":"https://www.cve.org/CVERecord?id=CVE-2026-97638"}],"remediation":[],"references":["https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=cve","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L3110","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/model/class-form-entry-model.php#L429","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L1685","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/custom-forms/front/front-action.php#L3662","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L196","https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127","https://plugins.trac.wordpress.org/changeset?reponame=&new=3732192%40forminator%2Ftags%2F1.57.3.1&old=3700727%40forminator%2Ftags%2F1.57.3","https://plugins.trac.wordpress.org/changeset/3732209/forminator/trunk/library/modules/custom-forms/front/front-action.php"],"sources":[{"name":"CVE","id":"CVE-2026-97638","modified":"2026-10-30T18:08:58.688Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97638"}],"assessments":[{"source":"Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T19:13:19.502Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T08:10:34.534Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}