CVE-2026-12998 is an authorization bypass vulnerability (CWE-639) in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The vulnerability arises from missing validation on a user-controlled 'draft' parameter, enabling unauthenticated attackers to enumerate sequential integer entry IDs and read other users' saved draft form data. This exposure includes personal information like names, email addresses, phone numbers, addresses, and free-form messages. The issue affects all plugin versions up to and including 1.55.0.2 and is only exploitable on forms with the 'Save and Continue' feature enabled.

An attacker can access sensitive personal data from other users' saved draft form entries without authentication. This compromises confidentiality but does not affect integrity or availability. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact to confidentiality only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the 'Save and Continue' feature on forms to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.