EUVD-2026-66274
GHSA-wjxr-7w8m-64j5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H captures the multisite-only requirement; S:C reflects crossing the authorization boundary to gain sub-site admin rights from an unauthenticated starting position.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
AnalysisAI
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress installation be configured as a multisite network - standard single-site WordPress deployments are entirely unaffected regardless of which plugin version is installed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N reflects the highly constrained exploitation context: the AC:H rating captures the specific requirement for a WordPress multisite deployment, substantially reducing the realistic exposed population compared to a standard single-site WordPress flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Forminator Forms to version 1.57.1 or later, the vendor-released patched version confirmed by WPScan and EUVD-2026-66274, with full advisory details at https://wpscan.com/vulnerability/99e2a045-15cb-4c58-8090-1f92474f6485/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator Forms
View allThe Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthoriz
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Repl
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today