CVE-2026-87068 Forminator Forms CVE debrief

Who should care

WordPress administrators and users with Forminator Forms plugin installed, especially those allowing quiz imports and user registration, should assess exposure and verify role validation to prevent potential unauthorized role elevation. This includes reviewing user roles and permissions for WordPress installations using Forminator Forms and verifying role validation for nested registration forms in imported quizzes.

Why it matters

CVE-2026-87068 allows a user with quiz import permissions to bypass role validation and grant arbitrary roles, including administrator, through a publicly reachable form. WordPress administrators and users with Forminator Forms plugin installed should assess exposure and verify role validation to prevent potential unauthorized role elevation.

• Potential unauthorized role elevation for users submitting forms
• Possible administrator account creation by low-privileged users
• Verification of role validation for nested registration forms required
• Assessment of user roles and permissions for WordPress installations using Forminator Forms necessary

Technical summary

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply role validation when a registration form is nested inside an imported quiz, allowing a user with quiz import permissions to publish a live form granting any role, including administrator. This vulnerability affects WordPress installations using Forminator Forms, particularly those allowing quiz imports and user registration. The vulnerability allows for potential unauthorized role elevation for users submitting forms and possible administrator account creation by low-privileged users.

Defensive priority

Assess exposure and verify role validation for Forminator Forms WordPress plugin

Recommended defensive actions

• Assess exposure to Forminator Forms WordPress plugin version before 1.57.2.1
• Verify role validation for nested registration forms in imported quizzes
• Review user roles and permissions for WordPress installations using Forminator Forms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Limited evidence available; official CVE and NVD records provide basic vulnerability details. The CVE Program and NVD records indicate that the Forminator Forms WordPress plugin before 1.57.2.1 is vulnerable. Defenders should verify role validation for nested registration forms in imported quizzes and assess exposure to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.