CVE-2026-87069
Received Received - Intake

Authenticated User Privilege Escalation in Forminator WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-87069
EUVD
EUVD-2026-85047

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wpform forminator_forms to 1.57.2.1 (exc)
wpscan forminator_forms to 1.57.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Forminator Forms WordPress plugin versions below 1.57.2.1. It allows any authenticated user, including Subscribers with no plugin permissions, to rewrite the saved field configuration of any form on the site, including live payment forms. This happens because the plugin does not perform a nonce, capability, or ownership check before running a one-time payment-field migration during the construction of an admin screen, which occurs on every wp-admin request for logged-in users.

Detection Guidance

Check the installed version of the Forminator Forms plugin in WordPress. If it is below 1.57.2.1, the system is vulnerable. Use the WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

An attacker could modify the configuration of any form on your site, including payment forms, potentially leading to unauthorized changes, data theft, or financial fraud. Even low-privilege users like Subscribers can exploit this to alter form fields without permission.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, such as payment information, which may violate compliance requirements like GDPR or HIPAA. Unauthorized changes to forms could expose personal data or payment details, risking legal penalties.

Mitigation Strategies

Update the Forminator Forms plugin to version 1.57.2.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update can be applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87069. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart