CVE-2026-87070: medium-severity vulnerability in Forminator Forms
Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.2%
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Forminator Formspublic PoCs found — 1
cve_referencewpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Forminator Forms
In the same product, most dangerous first.
CVE-2026-19221HIGHForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteEPSS 0.7%CVE-2026-87067HIGHForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object InjectionEPSS 0.5%CVE-2026-87068MEDIUMForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportEPSS 0.4%CVE-2026-19222MEDIUMForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassEPSS 0.4%CVE-2024-7052MEDIUMForminator < 1.38.3 - Admin+ Stored XSSEPSS 0.3%CVE-2026-87071MEDIUMForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted PostsEPSS 0.3%