HowToFixMe
● High · CVSS 7.5

How to Fix CVE-2026-5192: Forminator Forms Unauthenticated Arbitrary File Read

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

Last verified: 2026-05-25

CVE-2026-5192 lets an unauthenticated visitor read arbitrary files off your WordPress server through the Forminator Forms plugin (by WPMU DEV), versions up to and including 1.52.1. The bug lives in the upload-1[file][file_path] parameter, where path traversal sequences slip past validation and let an attacker pull back files like wp-config.php. The fix is a one-click plugin update in your WordPress dashboard. This page walks through confirming whether your site is exposed, updating the plugin, and locking down the specific form behaviour that turns the bug from theory into a live file leak.

⚡ At a glance
SeverityCVSS 7.5 - High
Actively exploited?Not listed on CISA KEV at time of writing
ProductForminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress plugin, by WPMU DEV)
Affected versionsAll releases up to and including 1.52.1
Fixed inThe patched release that follows 1.52.1 (changeset 3500671). Update to the latest Forminator; see the vendor advisory for the exact build number
Type (CWE)CWE-22 Path Traversal (unauthenticated arbitrary file read)
Attacker requirementUnauthenticated, network-reachable; a public form with a File Upload field plus Save and Continue and file-attaching email notifications must be configured

Exploitation status

There is no CISA KEV entry for CVE-2026-5192 at present, so active in-the-wild exploitation has not been officially confirmed for this CVE. Do not read that as all-clear: the KEV catalog often trails real-world attacks, so prioritise this on its severity rather than waiting for a listing.

Public exploit availability: no public proof-of-concept or Metasploit module is referenced in this record yet. That says nothing about private exploit code, so do not treat the issue as low risk just because none is published.

What is CVE-2026-5192?

Forminator is one of the most widely installed form builders on WordPress. It handles contact forms, payment forms, quizzes, and polls, and it ships a File Upload field so visitors can attach documents to a submission. CVE-2026-5192 is a path traversal flaw (CWE-22) in how that upload feature handles the file path supplied by the client.

The vulnerable input is the upload-1[file][file_path] parameter. Forminator trusts the path the browser sends instead of pinning it inside the intended upload directory. By stuffing that parameter with traversal sequences such as ../../../../wp-config.php, an attacker walks up and out of the upload folder and points the plugin at any file the web server user can read. Because the code path the plugin uses to attach saved files to a notification email then reads that file and ships its contents back out, the attacker receives the raw bytes of the targeted file.

Two things make this dangerous. First, no login is required: the CVSS vector is AV:N/AC:L/PR:N/UI:N, meaning network-reachable, low complexity, no privileges, no user interaction. Second, the impact is a clean read of arbitrary files. The most prized target on a WordPress host is wp-config.php, which holds the database name, user, password, and the authentication salts. With those, an attacker can connect to the database directly or forge session cookies.

There is one precondition that limits exposure, and it matters for triage. Per the advisory, exploitation requires a publicly accessible form that has a File Upload field, has Save and Continue enabled in that form's Behavior settings, and has the Save and Continue email notification configured to attach uploaded files. A site running Forminator with only plain contact forms, and no Save-and-Continue file-attaching notification, is far less reachable through this exact path. Full technical detail is in the Wordfence advisory and the source patch in WordPress.org changeset 3500671.

Why this CVE matters

The CVSS impact metrics are C:H/I:N/A:N: high confidentiality impact, no integrity or availability impact. In plain terms: this bug does not let an attacker change your files or take the site down, but it lets them read files they should never see. That is a confidentiality-only flaw, which is why the base score lands at 7.5 (High) rather than in critical territory. Do not let the lack of write access lull you, though. An arbitrary file read on WordPress is a stepping stone, not a dead end.

The realistic attack story runs like this. An attacker scans for sites running Forminator with a Save-and-Continue file upload form, hits the vulnerable parameter, and reads wp-config.php. Now they hold the database credentials and the secret keys WordPress uses to sign cookies. If the database is reachable, they log in directly. If it is not, the salts still let them craft valid auth cookies or accelerate offline cracking of stored hashes. From there, integrity and availability impact follow in a second stage that this CVE itself does not need to provide.

The CISA ADP record scores this as Automatable: yes, because the precondition is detectable and the exploit can be scripted across many hosts at once. That is the profile of a vulnerability mass scanners pick up quickly. Anyone running a public Forminator form with the affected configuration is exposed, regardless of how small the site is, because automated sweeps do not care about your traffic numbers. Updating the plugin removes the bug; the configuration workarounds below only shrink the window.

Am I affected?

You are affected if you run the Forminator Forms plugin at version 1.52.1 or any earlier release. Check the installed version first.

From the WordPress dashboard, go to Plugins > Installed Plugins and find "Forminator Forms". The version number is printed under the plugin name. If it reads 1.52.1 or lower, you are in the affected range.

If you manage the site over SSH and have WP-CLI installed, read the version straight from the command line:

# Print the installed Forminator version
wp plugin get forminator --field=version

# Or list it alongside its update status
wp plugin list --name=forminator --fields=name,status,version,update

You can also read it directly from the plugin header without WP-CLI:

grep -i "Version:" wp-content/plugins/forminator/forminator.php

The flaw only fires when a public form combines a File Upload field with Save and Continue and a file-attaching notification, so also audit your forms. In the dashboard open each form under Forminator > Forms, check the Behavior tab for Save and Continue, and check Email Notifications for any rule that attaches uploaded files. A form with that combination, reachable without login, is the exploitable surface.

How to fix CVE-2026-5192

This is a WordPress plugin vulnerability, so the fix is a plugin update, not an OS package upgrade and nothing to do with Windows. Update Forminator to the patched release that ships after 1.52.1 (the fix landed in changeset 3500671; the exact version number is in the vendor advisory). Take a backup first, then pick whichever method matches how you manage the site.

Option A: update from the WordPress dashboard

  1. Back up the database and the wp-content directory before you touch anything.
  2. Log in to wp-admin and open Plugins > Installed Plugins.
  3. Find Forminator Forms. If an update is available you will see an "update now" link directly under it; click it.
  4. If nothing appears, click Check for updates at the top, or go to Dashboard > Updates and run the update from there.
  5. After it finishes, confirm the version line no longer reads 1.52.1 or lower.

If you keep auto-updates on for plugins, Forminator may already have updated itself. Verify the version anyway rather than assuming.

Option B: update with WP-CLI (SSH)

# 1. Back up database and plugin files first
wp db export "wp-backup-$(date +%F).sql"
tar -czf "forminator-backup-$(date +%F).tgz" wp-content/plugins/forminator

# 2. Refresh the update cache, then update only Forminator
wp plugin update forminator

# 3. Confirm the new version
wp plugin get forminator --field=version

Run these as the user that owns the WordPress files so the update can write into wp-content/plugins cleanly.

Option C: manual update (no dashboard access)

If the admin UI is unreachable, you can swap the plugin folder by hand. Download the current Forminator release from the official WordPress.org plugin page, then replace the directory on the server:

# From the wp-content/plugins directory, with the new ZIP uploaded alongside
cp -a forminator "forminator.bak-$(date +%F)"   # keep a rollback copy
rm -rf forminator
unzip -q forminator.latest.zip                  # extracts a fresh ./forminator
# fix ownership to match your web server user (example: www-data)
chown -R www-data:www-data forminator

Keep the .bak copy until you have confirmed the site loads and the forms still submit, then delete it.

If you can't patch immediately

Updating the plugin is the only real fix. If you genuinely cannot update right this minute, the precondition gives you a fast way to disarm the bug: break the configuration the exploit depends on.

Disable the vulnerable form behaviour

Because exploitation needs Save and Continue plus a file-attaching email notification, removing either one closes the path:

If you can spare the feature, deactivating the whole Forminator plugin from Plugins > Installed Plugins (or wp plugin deactivate forminator) removes the attack surface completely until you update.

Block traversal patterns at the WAF

This is a real web-exploitable path traversal, so a request filter that drops ../ sequences in form parameters buys time. It is a stopgap that a determined attacker can encode around, not a fix. ModSecurity example:

# Append to /etc/modsecurity/rules/local.conf, then reload the web server.
SecRule ARGS_NAMES|ARGS "@rx (?:\.\./|\.\.\\\\|%2e%2e(?:%2f|%5c))" \
    "id:900192,phase:2,deny,status:403,log,msg:'CVE-2026-5192 path traversal attempt in form upload'"

sudo systemctl reload apache2    # or: sudo systemctl reload nginx

A managed WAF such as Cloudflare or Wordfence's own firewall can enforce the same pattern without editing config files.

How to verify the fix worked

The fix is a version bump, so the first check is the version string. Confirm Forminator is no longer in the affected range:

# Should print a release higher than 1.52.1
wp plugin get forminator --field=version

# Or grep the header directly
grep -i "Version:" wp-content/plugins/forminator/forminator.php

From the dashboard, the same confirmation is on Plugins > Installed Plugins: the version under Forminator should read higher than 1.52.1 with no pending update notice.

Behaviour test: re-test the form that previously had Save and Continue with a file-attaching notification. A traversal payload in the upload file_path parameter should no longer return file contents, because the patched plugin keeps the path inside the upload directory.

If the site was internet-facing and unpatched after disclosure (2026-05-04), assume the worst case and clean up. Because wp-config.php is the obvious target, treat its secrets as potentially leaked: review web server access logs for requests against the Forminator upload endpoint that carry ../ or encoded traversal in the parameters, rotate the WordPress database password, and regenerate the authentication keys and salts in wp-config.php (the official secret-key generator produces a fresh set). Rotating the salts invalidates every existing login cookie, which forces re-authentication and shuts out any forged sessions.

Frequently asked questions

Is CVE-2026-5192 being exploited in the wild?

Not as of this writing. It is not on the CISA KEV catalog, and the CISA ADP assessment records Exploitation as "none". However, that same assessment marks it Automatable: yes, so it is the kind of flaw mass scanners can sweep for at scale. Update promptly rather than waiting for confirmed attacks.

What is the CVSS score and what does the vector mean?

The base score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. That reads as: network-reachable, low complexity, no privileges, no user interaction, and a high confidentiality impact with no integrity or availability impact. It is an unauthenticated read-only file disclosure.

Which versions are affected and what is the fix?

Every Forminator Forms release up to and including 1.52.1 is vulnerable. The fix is the patched release that follows 1.52.1, delivered through changeset 3500671 on WordPress.org. Update the plugin to the latest version; the advisory names the exact fixed build.

I run Forminator but only use simple contact forms. Am I exploitable?

The exact attack path needs a public form with a File Upload field, Save and Continue enabled, and an email notification set to attach uploaded files. A site without that combination is much harder to hit through this CVE. Even so, update the plugin: relying on configuration to stay safe is fragile, and the patch costs nothing.

Will a WAF rule fully protect me?

No. Blocking ../ patterns stops opportunistic scanners and buys time, but encoding tricks can slip past a static rule. The plugin update is the only durable fix; disabling Save and Continue is a stronger stopgap than a WAF rule alone.

Other defects in the same area that deserve attention during this patch cycle:

References

Assembled from the Wordfence advisory, the MITRE CVE record, the WordPress.org source changeset, and the CISA ADP assessment. CVE-2026-5192 is not on the CISA KEV catalog at the time of writing. Always confirm against the vendor advisory before applying changes in production.