Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel listen_for_csv_export() function which correctly verifies user permissions. This makes it possible for authenticated attackers with subscriber-level access to configure a scheduled export job that emails all form submissions to an attacker-controlled email address, resulting in sensitive data exfiltration.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-07 | 2 | Disclosure1General1 |
| 2026-05-08 | 1 | General1 |
⚡ New CVE Alert: CVE-2026-6214 📊 Severity: 6.5 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6214 #CVE-2026-6214 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/G7RMoFlhuD
Post summary
The tweet announces a new medium‑severity CVE affecting WordPress (CVE‑2026‑6214) and provides a link to the NVD entry, but offers no additional technical, exploit, or mitigation details.
CVE-2026-6214 The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_sch… https://www.cve.org/CVERecord?id=CVE-2026-6214
Post summary
This text announces CVE-2026-6214, a missing authorization flaw in WordPress Forminator Forms plugin for versions up to 1.53.0.
CVE-2026-6214 Missing Authorization in Forminator Forms Plugin for WordPress Up ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6214 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post merely announces CVE‑2026‑6214 and links to a vulnerability detail page, offering no proof‑of‑concept, exploit code, active usage evidence, patch information, or technical specifics.