Forminator Forms CVE-2026-19220

Exploitation requires that the target WordPress installation be configured as a multisite network - standard single-site WordPress deployments are entirely unaffected regardless of which plugin version is installed. The Forminator Forms plugin must be active on the multisite network at a version prior to 1.57.1. No authentication is required per CVSS PR:N. The network's site registration setting is not a limiting factor - in fact, the vulnerability specifically manifests when registration is disabled at the network level but the plugin fails to honor that setting. The CVSS AC:H rating reflects the specificity of the multisite deployment requirement. No user interaction is needed and there are no platform or geographic restrictions.

The NVD CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N reflects the highly constrained exploitation context: the AC:H rating captures the specific requirement for a WordPress multisite deployment, substantially reducing the realistic exposed population compared to a standard single-site WordPress flaw. However, the I:L impact rating appears conservative given that successful exploitation confers full administrator privileges on a newly created sub-site - a foothold with meaningful lateral-movement potential within the broader multisite network. EPSS at 0.16% (5th percentile) and SSVC exploitation status of 'none' are consistent with the absence of a CISA KEV listing, suggesting no confirmed widespread or automated exploitation at the time of analysis. The existence of a WPScan-published proof-of-concept does lower the barrier for future opportunistic attacks. Overall this represents a moderate real-world priority specifically for multisite operators running the unpatched plugin; for single-site installations, the risk is zero and no action is required.

An unauthenticated attacker targeting internet-accessible WordPress multisite networks sends a crafted site-signup POST request through the Forminator Forms plugin endpoint, bypassing the network's registration enforcement entirely. The plugin processes the request, creates a new sub-site, and grants the attacker administrator rights over it. With sub-site admin access the attacker can install malicious plugins, inject arbitrary content, or attempt privilege escalation toward the network super-admin role. A public proof-of-concept published by WPScan confirms the feasibility of this sequence.