blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-87074

LOW 3.7 CVSS 3.1
Published
September 23, 2026
Last modified
September 23, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

Affected WordPress components

  • Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin · forminator
    Confirmed match Active
    From 1.17.1 (including) to 1.57.2.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Forminator Forms — From 1.17.1 (including) to 1.57.2.1 (excluding)

References

  • wpscan.com https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/
  • nvd.nist.gov Official NVD record