CVE-2026-87068
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz. This allows a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
Risk Assessment
A user with quiz import permissions can publish a form granting administrator role, leading to full site takeover. This poses a serious threat to the security of the WordPress installation.
Recommendation
Update the Forminator Forms plugin to version 1.57.2.1 or later. An audit of user permissions for quiz import and a review of existing registration forms are also recommended.
Other vulnerabilities in Forminator Forms WordPress plugin
See all- CVE-2026-97638High
The Forminator Forms plugin for WordPress in versions up to and including 1.57.3.1 is vulnerable to Insecure Direct Object Reference via the 'previous_draft_id' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions.
- CVE-2026-5461Medium
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. The plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter, allowing unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
- CVE-2026-87074Low
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.
- CVE-2026-87067High
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code.
Original NVD description (English source)
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS