CVE-2026-6214 — The Forminator Forms plugin for WordPress is vulnerable to
CVE-2026-6214 — The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled expor
What This Means For You
- If your environment is affected by CWE-862, review your exposure and prioritize patching based on your environment. Monitor vendor advisories for CVE-2026-6214 updates and patches.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6214 - Forminator Scheduled Export Configuration
title: CVE-2026-6214 - Forminator Scheduled Export Configuration
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
Detects the specific AJAX action used by the Forminator Forms plugin to save scheduled export configurations. This is the core vulnerability in CVE-2026-6214, allowing authenticated attackers to exfiltrate form data by configuring scheduled exports to an attacker-controlled email address.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-6214/
tags:
- attack.exfiltration
- attack.t1537
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=forminator_save_scheduled_export'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6214 | vulnerability | CVE-2026-6214 |
| CWE-862 | weakness | CWE-862 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 07, 2026 at 07:16 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-42194 — Server-Side Request Forgery
CVE-2026-42194 — Admidio is an open-source user management solution. Prior to version 5.0.9, the incomplete SSRF fix in Admidio's fetch_metadata.php validates the resolved IP address...
CVE-2026-41671 — Authentication Bypass
CVE-2026-41671 — Admidio is an open-source user management solution. Prior to version 5.0.9, the OIDC token introspection endpoint (/modules/sso/index.php/oidc/introspect) always returns {"active": true} for every...
CVE-2026-41670: Admidio SAML IdP Bypass Exposes User Data
CVE-2026-41670 — Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value...