CVE-2026-87070: falha de média gravidade em Forminator Forms
Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.2%
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Unknown · Forminator FormsPoCs públicas encontradas — 1
cve_referencewpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Forminator Forms
No mesmo produto, das mais perigosas para as menos.
CVE-2026-19221HIGHForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteEPSS 0.7%CVE-2026-87067HIGHForminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object InjectionEPSS 0.5%CVE-2026-87068MEDIUMForminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportEPSS 0.4%CVE-2026-19222MEDIUMForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassEPSS 0.4%CVE-2024-7052MEDIUMForminator < 1.38.3 - Admin+ Stored XSSEPSS 0.3%CVE-2026-87071MEDIUMForminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted PostsEPSS 0.3%