CVE-2026-87068: fallo de gravedad media en Forminator Forms
Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 6.6epss 0.4%
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Unknown · Forminator FormsPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/cc38d82b-a766-4da0-bf81-d9ba8fa9e51e/no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Forminator Forms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-19221HIGHForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteEPSS 0.7%CVE-2026-87067HIGHForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object InjectionEPSS 0.5%CVE-2026-19222MEDIUMForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassEPSS 0.4%CVE-2024-7052MEDIUMForminator < 1.38.3 - Admin+ Stored XSSEPSS 0.3%CVE-2026-87071MEDIUMForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted PostsEPSS 0.3%CVE-2026-87074LOWForminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled LinkEPSS 0.2%