{"affected":[{"defaultStatus":"unaffected","product":"Forminator Forms","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"cveId":"CVE-2026-111579","cwes":["CWE-269"],"description":"The Forminator Forms  WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/c490b47f-4898-4323-8bec-e32bc7732d1d/"}],"kev":null,"metrics":[],"modifiedAt":1794376806690,"publishedAt":1794376806690,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/c490b47f-4898-4323-8bec-e32bc7732d1d/"}],"remediation":[],"revision":"166142bf3c004e24508636a1f8ac6d7ef71ac694199cabccaf198ef14da55510","sources":[{"modifiedAt":1794376806690,"name":"CNA: WPScan","retrievedAt":1794377319343,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111579"}],"ssvc":null,"status":"published","title":"Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable","updatedAt":1794377319343}