blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-87070

MEDIUM 5.3 CVSS 3.1
Published
September 23, 2026
Last modified
September 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-348
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.

Affected WordPress components

  • Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin · forminator
    Confirmed match Active
    Before 1.57.2.1
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Forminator Forms — Before 1.57.2.1

References

  • wpscan.com https://wpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/
  • nvd.nist.gov Official NVD record