{
    "title": "Forminator",
    "seo_title": "Forminator: review, recommended settings and limits",
    "h1": "Forminator",
    "description": "Forminator: who it suits, its limits (frequent vulnerabilities, unlimited retention), anti-spam, GDPR and upload settings, and Forminator Pro pricing.",
    "lead": "Forminator is WPMU DEV’s free form builder, with payments, polls and quizzes built in. This sheet covers who it suits, its real limitations, the anti-spam, GDPR and file upload settings to apply, and why its security updates matter so much.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:09:04+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/forminator/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/forminator/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/forminator/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/forminator/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/forminator/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/forminator/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/forminator/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/forminator/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/forminator/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/forminator/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/forminator/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/forminator/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/forminator/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/forminator/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/forminator/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/forminator/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Forminator",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/forminator/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/forminator/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/forminator/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Forminator"
        },
        {
            "level": 2,
            "text": "What Forminator does on your site"
        },
        {
            "level": 2,
            "text": "Which sites Forminator suits best"
        },
        {
            "level": 2,
            "text": "Forminator strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The Forminator settings we recommend"
        },
        {
            "level": 2,
            "text": "Forminator vulnerabilities and the pace of its fixes"
        },
        {
            "level": 2,
            "text": "Forminator FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for taking Stripe or PayPal payments, building quote calculators or running polls without a license.\n- Main caveat: security flaws are patched very often, so updates must be applied quickly.\n- Free; Forminator Pro starts at $50 per year for one site and adds PDFs, e-signatures, Stripe subscriptions.\n\n## What Forminator does on your site\n\nForminator is WPMU DEV’s form builder, listed on wordpress.org since 2018. You build forms by drag and drop in the dashboard, from a template or a blank canvas, then embed them with the Forminator block or a shortcode. The same plugin also runs polls with live results and quizzes, with a built-in lead form to capture contacts.\n\nThe free version goes a long way: conditional logic, calculation fields, multi-file uploads, repeatable field groups, registration and login forms, save-and-continue drafts, and Stripe and PayPal payments. Submissions are stored in the database and listed under Forminator > Submissions. An import wizard brings over your [Contact Form 7](https://www.wp-masquerade.com/features/camouflaged-plugins/contact-form-7/) forms, and native integrations send data to Mailchimp, HubSpot, Google Sheets, Slack, Trello or a webhook (Zapier, Make, n8n).\n\nThe business model is Forminator Pro, sold by WPMU DEV from $50 per year for one site, $75 for 3 sites and $100 for 10 sites. Pro adds four features: Stripe subscriptions, PDF generation, geolocation with address autocomplete, and an e-signature field. A free WPMU DEV account, connected through the Hub, also unlocks cloud templates.\n\n![Diagram: Forminator works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); tag IDs (hidden with Pro); JavaScript variables (still visible); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/forminator/diagram-en.svg?v=7ae0bd2b)\n\n## Which sites Forminator suits best\n\n- **Small businesses and nonprofits** that want to take a deposit, a donation or a simple order through Stripe or PayPal without buying a license.\n- **Quote and booking sites**: calculation fields for a price estimator, date limits on the calendar, multi-step forms.\n- **Media and content sites** that want polls and quizzes without adding a second plugin.\n- **Sites moving off Contact Form 7** to keep messages in the dashboard and get a visual editor.\n\nIt is not the best pick for a site that only needs a contact form: every module (payments, registration, polls, quizzes) adds code to keep an eye on, and the plugin ships security fixes very often. If you cannot apply updates quickly, a simpler plugin lowers the risk. To compare another visual builder, see our [WPForms](https://www.wp-masquerade.com/features/camouflaged-plugins/wpforms/) sheet.\n\n## Forminator strengths and limitations\n\n### Strengths\n\n- **A generous free version.** Conditional logic, calculations, multi-file uploads and Stripe and PayPal payments need no license.\n- **Your pick of anti-spam tools.** reCAPTCHA, hCaptcha, Cloudflare Turnstile, a honeypot, Akismet, and allow or block lists for addresses and domains.\n- **Stored, configurable submissions.** Entries stay in the dashboard, with retention periods for submissions and IP addresses that you can set for GDPR.\n- **Affordable Pro.** The four paid features cost $50 per year for one site.\n\n### Limitations\n\n- **Many vulnerabilities.** Patchstack lists more than seventy patched flaws, about thirty of them published between mid-August and early November 2026.\n- **Unlimited retention by default.** Submissions and IP addresses are kept forever until you set a period.\n- **Broad file types by default.** An upload field accepts every type WordPress allows, minus a list of dangerous types the plugin blocks.\n- **Pro-only features.** Stripe subscriptions, submission PDFs, e-signatures and geolocation are paid.\n- **WPMU DEV ecosystem.** Cloud templates require connecting the site to the Hub with a WPMU DEV account.\n\n## The Forminator settings we recommend\n\nGlobal settings live under Forminator > Settings; per-form settings are in the form editor, on the Behavior tab.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **Submissions Retention**  Forminator > Settings > Submissions > Forms Privacy | A custom period that fits your use, for example 12 months | By default everything is kept forever; GDPR expects a limited period. |\n| **IP Retention**  Same screen, for forms and polls | A short period, for example 1 month | Polls use the IP to block repeat votes, so a very short period reopens voting. |\n| **Enable Honeypot protection**  Form editor > Behavior > Security | On for every form | A [honeypot](https://www.wp-masquerade.com/glossary/honeypot/) traps bots without bothering visitors. |\n| **Cloudflare Turnstile**  Forminator > Settings > CAPTCHA | Site Key and Secret Key, then a Captcha field set to this provider in the form | Turnstile is free and usually asks nothing of the visitor. |\n| **Akismet spam protection**  Behavior > Security | On, set to “Mark as Spam” | Suspicious entries stay reviewable with the Spam filter instead of being lost; Akismet must be active with a key. |\n| **Allowed file types**  File Upload field > Settings | Specific file types: only what you expect (for example PDF), plus a file size limit | Limits what an attacker can drop into `wp-content/uploads/forminator/`. |\n| **Upload method**  File Upload field in multiple mode | On form submission | With AJAX, files reach the server even if the form is never submitted. |\n| **Sender email address**  Forminator > Settings > General > From Headers | An address on the site’s domain; Reply-to Email set to `{email-1}` in the notification’s Advanced tab | An outside address lands in spam. With a plugin like [WP Mail SMTP](https://www.wp-masquerade.com/features/camouflaged-plugins/wp-mail-smtp/), let the SMTP sender apply. |\n| **Load form using AJAX**  Behavior > Rendering | On if a caching plugin caches your pages | Keeps a cached form from failing on submit; send a test entry after the change. |\n\n- Submit a test form and check that the notification reaches the inbox and the entry appears under Forminator > Submissions.\n- Turn on auto-updates for Forminator under Plugins > Installed Plugins.\n- Under Forminator > Settings > Permissions, give access to entries only to the roles that need it.\n\n## Forminator vulnerabilities and the pace of its fixes\n\nForminator’s most serious flaws involve files sent through forms. CVE-2023-4596, rated 9.8, let anyone without an account upload an arbitrary file to the server, up to version 1.24.6. CVE-2024-28890, an upload of dangerous file types, was fixed in 1.29.0. CVE-2025-6463, rated 8.8, let a submission carry the path of a server file that was then deleted along with that submission, up to version 1.44.2.\n\nSince August 2026 the plugin has shipped one security release after another: unauthenticated file uploads, shortcode execution, privilege escalation, stored XSS. The vendor handles reports through Patchstack’s disclosure program, and at the time of writing no known flaw is open in version 1.58.4. At this pace, being one version behind is enough to expose a site, so auto-updates are the most useful setting (see our guide to plugin auto-updates).\n\nWP Masquerade Pro removes some of the traces that reveal Forminator to bots (the next section lists which), which makes it harder to spot without replacing the patch.\n\n## Forminator FAQ\n\n**Is Forminator really free?**\n\nYes. The wordpress.org version covers forms with conditional logic, calculations and Stripe or PayPal payments. Forminator Pro, from $50 per year for one site, adds Stripe subscriptions, PDFs, e-signatures and geolocation.\n\n**Can I stop saving submissions to the database?**\n\nYes: on the form’s Settings tab, the Data Storage section lets you turn storage off. With a Stripe field, pending submissions are still stored until the payment completes. To choose retention periods, see our article on GDPR and WordPress security.\n\n**How do I switch from Contact Form 7 to Forminator?**\n\nForminator > Settings > Import brings in all your Contact Form 7 forms or a selection. CAPTCHA and additional settings are not carried over: set them up again, then test each form.\n\n**Why aren’t notifications arriving?**\n\nFirst check that WordPress sends its own emails, such as a password reset. The vendor then recommends sending through SMTP and, in that case, leaving the notification’s From Email field empty.\n\n**Which WordPress and PHP versions do I need?**\n\nForminator requires at least WordPress 6.4 and PHP 7.4.\n\n## Key facts\n\n- Category: Forms\n- Vendor: WPMU DEV\n- Price: Free; Forminator Pro from $50 per year for one site\n- Active installations (wordpress.org): 600 000+\n- Version: 1.58.4\n- Official page: https://wordpress.org/plugins/forminator/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, tag IDs\n- Still visible: JavaScript variables, CSS classes",
    "catalog": "forminator",
    "essentials": [
        "Best for taking Stripe or PayPal payments, building quote calculators or running polls without a license.",
        "Main caveat: security flaws are patched very often, so updates must be applied quickly.",
        "Free; Forminator Pro starts at $50 per year for one site and adds PDFs, e-signatures, Stripe subscriptions."
    ],
    "format": "application/json"
}