CVE-2026-87068
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz. This allows a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
Risk Assessment
A user with quiz import permissions can publish a form granting administrator role, leading to full site takeover. This poses a serious threat to the security of the WordPress installation.
Recommendation
Update the Forminator Forms plugin to version 1.57.2.1 or later. An audit of user permissions for quiz import and a review of existing registration forms are also recommended.
Other vulnerabilities in Forminator Forms WordPress plugin
See all- CVE-2026-87074Low
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.
- CVE-2026-87067High
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code.
Original NVD description (English source)
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.