The Forminator WordPress plugin up to and including version 1.52.0 has an authorization bypass vulnerability. This flaw allows unauthenticated attackers to manipulate Stripe PaymentIntent identifiers in the public payment flow, enabling them to submit paid forms as completed without proper payment. This results in underpayment or payment bypass conditions.