The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress contains an Insecure Direct Object Reference vulnerability (CWE-639) in all versions up to 1.55.0.2. The vulnerability arises from insufficient validation of the 'draft' parameter, which is user-controlled. This allows unauthenticated attackers to enumerate sequential integer entry IDs and read other users' saved draft form data. The issue is exploitable only on forms where the 'Save and Continue' feature is enabled, exposing sensitive user information such as names, emails, phone numbers, addresses, and free-form messages. No official remediation or patch has been indicated in the provided data.

An unauthenticated attacker can access saved draft form data of other users by enumerating draft entry IDs via the vulnerable 'draft' parameter. This leads to unauthorized disclosure of personal information including names, email addresses, phone numbers, addresses, and message content. The vulnerability does not affect integrity or availability but compromises confidentiality of user data in draft forms with the 'Save and Continue' feature enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the 'Save and Continue' feature on forms to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.