CVE-2026-111579

{
  "etk_id": "ETK-2026-4145",
  "cve_id": "CVE-2026-111579",
  "display_id": "CVE-2026-111579",
  "ghsa_id": "GHSA-59qc-m59w-2g85",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Server-side payment enforcement bypass in Forminator Forms",
  "summary": "Forminator Forms versions before 1.58.4 may allow unauthenticated visitors to register through payment-gated user-registration forms without completing payment. The issue applies when the form's payment gateway was configured previously but is later disconnected or unavailable, and the resulting account may receive the role configured by the form.",
  "mitigation": "Update Forminator Forms to version 1.58.4 or later. Until updated, disable affected payment-gated registration forms and review configured registration roles, especially administrative roles.",
  "vendor": null,
  "product": "Forminator Forms",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.58.0, < 1.58.4"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.58.4"
      ],
      "package_name": "Forminator Forms",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-11-11T06:00:06.690000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T06:00:06.690000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T06:00:06.690000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111579"
    }
  }
}