{"affected":[{"defaultStatus":"unaffected","product":"Forminator Forms","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.58.4","status":"affected","version":"1.58.0","versionType":"semver"}]}],"cveId":"CVE-2026-111597","cwes":["CWE-200"],"description":"The Forminator Forms  WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/"}],"kev":null,"metrics":[],"modifiedAt":1794376806888,"publishedAt":1794376806888,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/10aa446f-3664-4deb-ace6-01d5c47d7103/"}],"remediation":[],"revision":"9ad781ff074969a70cb765dbf1bce478b27d927ab64f72141ab8f610aeeb240c","sources":[{"modifiedAt":1794376806888,"name":"CNA: WPScan","retrievedAt":1794377320453,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111597"}],"ssvc":null,"status":"published","title":"Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session","updatedAt":1794377320453}