CVE-2026-87074
Received Received - Intake

Email Spoofing via Draft Notification in Forminator WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-87074
EUVD
EUVD-2026-85048

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpforms forminator_forms to 1.57.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Forminator Forms WordPress plugin before version 1.57.2.1. It allows unauthenticated attackers to send emails from the website's mail server to any recipient. The attacker controls both the recipient's email address and the message content, including a link of their choice. The plugin fails to bind saved-draft notifications to the visitor who created the draft and accepts recipient and link details directly from user requests without proper authorization.

Detection Guidance

Check if your Forminator Forms WordPress plugin version is below 1.57.2.1. Logs may show unusual email activity sent from your server to external addresses. Review saved draft notifications for unauthorized recipients or links.

Impact Analysis

An attacker could use this vulnerability to send phishing emails or spam from your website, potentially damaging your reputation. They could also trick recipients into clicking malicious links, leading to further security breaches or data theft. The vulnerability allows unlimited email sends due to a replayable token.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive data is exposed through phishing emails sent via the compromised plugin. It may violate data protection requirements by enabling unauthorized email transmissions from your systems.

Mitigation Strategies

Update the Forminator Forms plugin to version 1.57.2.1 or later immediately. Disable saved-draft notifications if not required. Monitor email server logs for suspicious outbound messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart