EUVD-2026-83670
GHSA-h6cq-4ghp-3r32
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable via XML-RPC (AV:N); needs a viable gadget chain (AC:H); requires the delegated forms-management capability (PR:L); RCE escaping the app to the host justifies S:C with full C/I/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
Articles & Coverage 1
AnalysisAI
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an account holding the Forminator Forms 'forms-management' permission - administrator by default, but exploitable by lower roles only if the site has explicitly delegated that capability through Forminator's own settings. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue that warrants prompt patching, but its severity is tempered by the access prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update Forminator Forms to 1.57.2.1 or later - the vendor-released patched version - which constrains class instantiation during deserialization of XML-RPC input; apply this update through the normal WordPress plugin update path and verify the installed version afterwards. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, produce a complete inventory of every WordPress instance running Forminator Forms and confirm which ones are on versions below 1.57.2.1; where the plugin is not business-critical, disable and remove it immediately, and on the remainder audit which users and roles currently hold forms-management capability, revoking it from anyone who does not strictly require it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator Forms
View allAn authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 throu
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthoriz
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Repl
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today