EUVD-2026-64221
GHSA-qgqp-6jf7-rv3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain site admin credentials
-
DeliveryAuthenticate to WordPress subsite admin panel
-
ExploitSubmit malicious payload to Forminator network-wide setting
-
ExecutionCode executes in network administrator context
-
ImpactFull code execution across all network sites
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress site administrator account on ANY subsite of a vulnerable WordPress Multisite installation - site admin is a role routinely delegated to clients, tenants, and developers in shared multisite environments. The plugin Forminator Forms (versions 1.40.0 to <1.57.0.5) must be network-activated or otherwise present and exposing the vulnerable network-wide settings endpoint. Exploitation is limited to WordPress Multisite deployments; standard single-site WordPress installations do not have the vulnerable privilege boundary. No special configuration beyond Multisite mode and plugin installation is required. The CVSS PR:H metric confirms authentication as a hard prerequisite - unauthenticated exploitation is not possible. |
| Impact | The NVD-assigned CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the requirement for high-privilege credentials (PR:H), which bounds the attack surface to authenticated site administrators. However, the S:U (no scope change) designation arguably underrepresents real-world impact: exploitation causes code execution across the ENTIRE multisite network, not just the vulnerable site - a cross-boundary escalation that aligns with S:C semantics. EPSS at 0.18% (8th percentile) indicates no current automated exploitation pipeline, and there is no CISA KEV listing. No POC is referenced in available intelligence. Despite low EPSS, this vulnerability is a high-priority remediation target for any organization running WordPress Multisite, because site administrator accounts are commonly delegated to tenants, clients, or external teams who are not trusted with network-wide control - the attacker prerequisite (site admin role) is frequently satisfied in shared-hosting and agency multisite deployments. |
| Exploit ScenarioDerived | An attacker who has obtained site administrator credentials for any single subsite on a WordPress Multisite network - through phishing, credential stuffing, or a compromised tenant account - navigates to the Forminator Forms network-level configuration UI. By submitting a crafted value to the improperly restricted network-wide setting, the attacker causes arbitrary PHP code to execute in the network context, achieving full compromise of all sites hosted on the network including those the attacker has no legitimate access to. No public exploit code is referenced in available intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 23, 2026
Privilege boundary bypass in the Forminator Forms WordPress plugin (versions 1.40.0 through 1.57.0.5) enables any site-level administrator on a WordPress multisite network to modify a network-wide setting that triggers arbitrary code execution across all sites on the network, effectively allowing lateral escalation from single-site admin to full network compromise. This collapses the critical trust boundary between WordPress multisite's site administrator and network (super) administrator roles. No public exploit or CISA KEV listing exists at time of analysis, but the EPSS score of 0.18% (8th percentile) indicates low automated exploitation activity - not low potential impact.
RemediationAI
Upgrade the Forminator Forms plugin to version 1.57.0.5 or later, which is the vendor-confirmed patched release per WPScan advisory https://wpscan.com/vulnerability/5aa85c72-2a60-4243-b370-ef0b46e98cfe/. The upgrade can be performed through the WordPress plugin dashboard (Plugins → Updates) or via WP-CLI with 'wp plugin update forminator'. If immediate upgrade is not feasible, the most effective compensating control is to audit and minimize the number of accounts holding the site administrator role across all subsites - each site admin is a potential exploitation point. Temporarily demoting untrusted or dormant site admin accounts to editor role eliminates the attack surface without requiring a maintenance window. Disabling the Forminator Forms plugin entirely until patching is possible is also viable for networks where the plugin is non-critical. No network-level block is effective since exploitation flows through the legitimate WordPress admin interface over HTTPS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WordPress Multisite architecture segregates permissions between network administrators (super admins) who manage the entire installation and site administrators who manage individual subsites. CWE-94 (Improper Control of Code Generation / Code Injection) describes the root cause: the Forminator Forms plugin exposes a network-wide configuration setting without enforcing that only network administrators can write to it. A site admin, normally restricted to their subsite's scope, can therefore write to this setting and cause code to be evaluated across the entire network context. The affected product range per EUVD is Forminator Forms 1.40.0 through versions before 1.57.0.5. The injection vector operates over the network through the WordPress admin HTTP interface, consistent with the CVSS AV:N metric.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
S:C selected over NVD's S:U because exploitation causes code execution beyond the vulnerable site, across the entire multisite network; PR:H confirmed by site-admin prerequisite.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Executive ViewAI
Forminator Forms plugin versions 1.40.0-1.57.0.5 contain a privilege escalation vulnerability allowing site administrators to execute arbitrary code across an entire WordPress multisite network. The flaw breaks the critical security boundary between site-level and network-level administrator roles, creating potential for unauthorized network-wide compromise through a single compromised site administrative account.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB