What Forminator does on your site
Forminator is WPMU DEV’s form builder, listed on wordpress.org since 2018. You build forms by drag and drop in the dashboard, from a template or a blank canvas, then embed them with the Forminator block or a shortcode. The same plugin also runs polls with live results and quizzes, with a built-in lead form to capture contacts.
The free version goes a long way: conditional logic, calculation fields, multi-file uploads, repeatable field groups, registration and login forms, save-and-continue drafts, and Stripe and PayPal payments. Submissions are stored in the database and listed under Forminator > Submissions. An import wizard brings over your Contact Form 7 forms, and native integrations send data to Mailchimp, HubSpot, Google Sheets, Slack, Trello or a webhook (Zapier, Make, n8n).
The business model is Forminator Pro, sold by WPMU DEV from $50 per year for one site, $75 for 3 sites and $100 for 10 sites. Pro adds four features: Stripe subscriptions, PDF generation, geolocation with address autocomplete, and an e-signature field. A free WPMU DEV account, connected through the Hub, also unlocks cloud templates.
Which sites Forminator suits best
- Small businesses and nonprofits that want to take a deposit, a donation or a simple order through Stripe or PayPal without buying a license.
- Quote and booking sites: calculation fields for a price estimator, date limits on the calendar, multi-step forms.
- Media and content sites that want polls and quizzes without adding a second plugin.
- Sites moving off Contact Form 7 to keep messages in the dashboard and get a visual editor.
It is not the best pick for a site that only needs a contact form: every module (payments, registration, polls, quizzes) adds code to keep an eye on, and the plugin ships security fixes very often. If you cannot apply updates quickly, a simpler plugin lowers the risk. To compare another visual builder, see our WPForms sheet.
Forminator strengths and limitations
Strengths
- A generous free version. Conditional logic, calculations, multi-file uploads and Stripe and PayPal payments need no license.
- Your pick of anti-spam tools. reCAPTCHA, hCaptcha, Cloudflare Turnstile, a honeypot, Akismet, and allow or block lists for addresses and domains.
- Stored, configurable submissions. Entries stay in the dashboard, with retention periods for submissions and IP addresses that you can set for GDPR.
- Affordable Pro. The four paid features cost $50 per year for one site.
Limitations
- Many vulnerabilities. Patchstack lists more than seventy patched flaws, about thirty of them published between mid-August and early November 2026.
- Unlimited retention by default. Submissions and IP addresses are kept forever until you set a period.
- Broad file types by default. An upload field accepts every type WordPress allows, minus a list of dangerous types the plugin blocks.
- Pro-only features. Stripe subscriptions, submission PDFs, e-signatures and geolocation are paid.
- WPMU DEV ecosystem. Cloud templates require connecting the site to the Hub with a WPMU DEV account.
The Forminator settings we recommend
Global settings live under Forminator > Settings; per-form settings are in the form editor, on the Behavior tab.
| Setting | Recommended value | Why |
|---|---|---|
| Submissions Retention Forminator > Settings > Submissions > Forms Privacy | A custom period that fits your use, for example 12 months | By default everything is kept forever; GDPR expects a limited period. |
| IP Retention Same screen, for forms and polls | A short period, for example 1 month | Polls use the IP to block repeat votes, so a very short period reopens voting. |
| Enable Honeypot protection Form editor > Behavior > Security | On for every form | A honeypot traps bots without bothering visitors. |
| Cloudflare Turnstile Forminator > Settings > CAPTCHA | Site Key and Secret Key, then a Captcha field set to this provider in the form | Turnstile is free and usually asks nothing of the visitor. |
| Akismet spam protection Behavior > Security | On, set to “Mark as Spam” | Suspicious entries stay reviewable with the Spam filter instead of being lost; Akismet must be active with a key. |
| Allowed file types File Upload field > Settings | Specific file types: only what you expect (for example PDF), plus a file size limit | Limits what an attacker can drop into wp-content/uploads/forminator/. |
| Upload method File Upload field in multiple mode | On form submission | With AJAX, files reach the server even if the form is never submitted. |
| Sender email address Forminator > Settings > General > From Headers | An address on the site’s domain; Reply-to Email set to {email-1} in the notification’s Advanced tab | An outside address lands in spam. With a plugin like WP Mail SMTP, let the SMTP sender apply. |
| Load form using AJAX Behavior > Rendering | On if a caching plugin caches your pages | Keeps a cached form from failing on submit; send a test entry after the change. |
- Submit a test form and check that the notification reaches the inbox and the entry appears under Forminator > Submissions.
- Turn on auto-updates for Forminator under Plugins > Installed Plugins.
- Under Forminator > Settings > Permissions, give access to entries only to the roles that need it.
Forminator vulnerabilities and the pace of its fixes
Forminator’s most serious flaws involve files sent through forms. CVE-2023-4596, rated 9.8, let anyone without an account upload an arbitrary file to the server, up to version 1.24.6. CVE-2024-28890, an upload of dangerous file types, was fixed in 1.29.0. CVE-2025-6463, rated 8.8, let a submission carry the path of a server file that was then deleted along with that submission, up to version 1.44.2.
Since August 2026 the plugin has shipped one security release after another: unauthenticated file uploads, shortcode execution, privilege escalation, stored XSS. The vendor handles reports through Patchstack’s disclosure program, and at the time of writing no known flaw is open in version 1.58.4. At this pace, being one version behind is enough to expose a site, so auto-updates are the most useful setting (see our guide to plugin auto-updates).
WP Masquerade Pro removes some of the traces that reveal Forminator to bots (the next section lists which), which makes it harder to spot without replacing the patch.
What WP Masquerade hides for Forminator
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Forminator: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
ForminatorFront - CSS classes
forminator-ui, forminator-custom-form
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Forminator FAQ
Is Forminator really free?
Yes. The wordpress.org version covers forms with conditional logic, calculations and Stripe or PayPal payments. Forminator Pro, from $50 per year for one site, adds Stripe subscriptions, PDFs, e-signatures and geolocation.
Can I stop saving submissions to the database?
Yes: on the form’s Settings tab, the Data Storage section lets you turn storage off. With a Stripe field, pending submissions are still stored until the payment completes. To choose retention periods, see our article on GDPR and WordPress security.
How do I switch from Contact Form 7 to Forminator?
Forminator > Settings > Import brings in all your Contact Form 7 forms or a selection. CAPTCHA and additional settings are not carried over: set them up again, then test each form.
Why aren’t notifications arriving?
First check that WordPress sends its own emails, such as a password reset. The vendor then recommends sending through SMTP and, in that case, leaving the notification’s From Email field empty.
Which WordPress and PHP versions do I need?
Forminator requires at least WordPress 6.4 and PHP 7.4.