blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-87068

MEDIUM 6.6 CVSS 3.1
Published
September 20, 2026
Last modified
September 21, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-269
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.

Affected WordPress components

  • Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin · forminator
    Confirmed match Active
    From 1.57.0 (including) to 1.57.2.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Forminator Forms — From 1.57.0 (including) to 1.57.2.1 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/cc38d82b-a766-4da0-bf81-d9ba8fa9e51e/
  • nvd.nist.gov Official NVD record