Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-87068

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-87068

Published

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-87068

Published

Forminator Forms

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Forminator Forms",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.57.0",
                            "lessThan": "1.57.2.1"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON