Forminator Forms CVE-2026-18323

Exploitation requires that the targeted WordPress site has the Forminator Forms plugin installed and active at version 1.57.0.2 or earlier, and that at least one published form includes a Radio field type with the Save-and-Continue draft feature enabled - this is the specific configuration that exposes the vulnerable nopriv AJAX endpoint. The injection phase requires no authentication, no prior account, and no special network position; the attacker need only be able to reach the WordPress AJAX endpoint (wp-admin/admin-ajax.php). Execution of the stored payload requires an authenticated WordPress administrator to navigate to the Submissions admin page for the affected form; this is the only limiting factor and is a routine administrative action. Non-default configuration is not required beyond the presence of a radio field in a Save-and-Continue-enabled form. Exploitation is limited to sites where an administrator actively reviews form submissions - sites that never visit the Submissions admin page would not trigger execution, though the payload remains stored.

The CVSS 3.1 base score of 7.2 is derived from a Scope:Changed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The PR:N rating is confirmed by the nopriv AJAX registration described in the CVE. However, UI:N in the provided vector is a point of tension: stored XSS canonically requires a second-party (here, an administrator) to load the injected page for the payload to fire, which would normally assign UI:R. If UI:N reflects only the injection phase (which requires no interaction beyond the attacker's own request), the scorer may have bifurcated injection and execution - a non-standard interpretation that should be verified with the vendor or Wordfence advisory. An independently assessed vector using UI:R would yield a slightly lower score (~6.1) but arguably better reflects true exploitation flow. EPSS data was not supplied; given the unauthenticated, low-complexity attack path against a widely-deployed plugin, real-world exploitation probability is likely moderate to elevated. No CISA KEV listing and no public PoC are identified at time of analysis. The practical impact targets administrators: a successful payload executing in an admin session can create rogue admin accounts, install backdoor plugins, or exfiltrate nonces - all high-value outcomes despite the CVSS C:L/I:L designation. This is a genuine priority for sites using Forminator with public-facing forms that include radio fields with Save-and-Continue enabled.

An unauthenticated attacker submits a crafted Save-and-Continue draft request to the Forminator nopriv AJAX endpoint, supplying a radio field value containing a malicious JavaScript payload wrapped in an Inputmask-compatible data-attribute expression rather than a legitimate predefined option - the missing server-side option-membership check allows this to persist in the database. When a WordPress administrator subsequently opens the Submissions detail view for the affected form, the Inputmask library processes the stored data-attribute, auto-executing the attacker's script in the admin's browser context, enabling session hijacking, admin account creation, or plugin installation. No public exploit code is identified at time of analysis, but the attack path is mechanically straightforward for any researcher familiar with WordPress AJAX internals.