CVE-2026-97638

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.3.2

Description An Insecure Direct Object Reference occurs due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts of other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This exploitation requires the attacker to obtain a victim's draft id, which can be harvested from a shared "continue later" link. The nonce check is bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page. The issue is triggered via the previous draft id parameter.

Recommendations Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.3.2 or later.