CVE-2026-87068 in Forminator Forms Plugin
Summary
by MITRE • 09/20/2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in Forminator Forms for WordPress prior to version 1.57.2.1 represents a critical authorization bypass stemming from inconsistent input validation logic within the plugin's codebase. This flaw specifically affects the mechanism used when registration forms are nested inside imported quizzes, creating a significant security gap that allows unauthorized privilege escalation. The core issue lies in the failure of the application to enforce role-based access control checks during this specific workflow path, despite such validations being correctly implemented and enforced in other areas of the plugin, including the standard form editor and direct form import processes. This inconsistency creates an exploitable condition where a user with permissions to import quizzes can manipulate the system to bypass administrative safeguards that are otherwise strictly applied.
From a technical perspective, the vulnerability exploits the disparity between how different modules within the Forminator ecosystem handle capability verification. When a registration form is embedded within a quiz structure and subsequently imported via the quiz import functionality, the application fails to validate whether the user submitting or configuring this nested form possesses the necessary administrative privileges required for role assignment operations. In contrast, when attempting to create an identical configuration through the ordinary form editor or by importing forms directly as standalone entities, the system correctly rejects such actions if the user lacks appropriate permissions. This discrepancy indicates that the quiz import module does not inherit or replicate the rigorous security checks present in the primary form management interfaces, effectively leaving a backdoor for privilege escalation open to any authenticated user who can trigger the quiz import process.
The operational impact of this vulnerability is severe, as it enables an attacker with relatively low-level privileges to escalate their access rights to that of a system administrator or other high-privilege roles on the WordPress installation. By submitting a crafted registration form nested within an imported quiz, an unauthorized user can assign administrative capabilities to themselves or any other account specified in the submission data. Once these elevated permissions are granted, the attacker gains full control over the website environment. This level of access allows for complete compromise of the underlying system, including the ability to modify core files, install malicious plugins, exfiltrate sensitive database information containing user credentials and personal data, and potentially pivot to attack other systems within the network infrastructure connected to or hosted on the compromised server.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically highlighting cases where an actor is granted privileges that exceed their assigned role due to flawed validation logic. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation relies on using legitimate but insufficiently privileged credentials to gain higher-level access through a misconfiguration in authorization checks. The scenario also reflects aspects of CWE-284, Improper Access Control, where the application fails to properly restrict actions based on user roles during specific operational workflows. Understanding these mappings is crucial for security teams aiming to categorize and prioritize remediation efforts according to established industry frameworks.
To mitigate this risk, administrators must immediately update the Forminator Forms plugin to version 1.57.2.1 or later, where the developers have addressed the inconsistency in role validation logic across all import and creation pathways. Until an upgrade is feasible, it is advisable to restrict the ability of non-administrative users to import quizzes or forms that contain registration fields capable of assigning roles. Implementing strict file integrity monitoring can also help detect unauthorized changes resulting from exploitation attempts. Additionally, applying the principle of least privilege across all user accounts ensures that even if such a vulnerability were present in other components, the potential blast radius would be significantly reduced by limiting the scope of actions any single compromised account could perform within the WordPress environment.