Forminator Forms CVE-2026-87067

Requires an account holding the Forminator Forms 'forms-management' permission - administrator by default, but exploitable by lower roles only if the site has explicitly delegated that capability through Forminator's own settings. The XML-RPC interface must be reachable, and successful code execution depends on a usable PHP POP/gadget chain being present so the unrestricted deserialization can be leveraged into a file write. Limiting factors: PR:L (authenticated with a specific privileged capability, not anonymous) and AC:H (gadget-chain and XML-RPC dependency). On sites where only administrators hold the permission, real-world risk is materially lower since such users are already highly privileged.

This is a genuine high-priority issue that warrants prompt patching, but its severity is tempered by the access prerequisite. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H = 8.5) reflects an unrestricted-deserialization PHP object injection reachable over the network through XML-RPC, yielding full C/I/A impact via arbitrary file write and code execution. Two signals raise concern: WPScan (the reporter) states publicly available exploit code exists, and a vendor patch (1.57.2.1) is available. Two signals lower it: PR:L means the attacker must already hold the plugin's forms-management permission (administrator by default, only lower roles if the site explicitly delegated it), and AC:H reflects that successful exploitation depends on a usable POP gadget chain and XML-RPC being enabled. No EPSS score or CISA KEV status was provided, so there is no evidence of active in-the-wild exploitation - this is 'publicly available exploit code exists,' NOT confirmed exploitation. The 'unknown' CPE vendor string and 'Unknown' tag are placeholder junk, not a data conflict about the vulnerability itself. Net: real priority for any site that has delegated the forms-management capability below administrator; lower urgency where only admins hold it, since an admin already has extensive control.

An attacker who holds (or has been delegated) Forminator's forms-management permission on a WordPress site sends a crafted XML-RPC request containing a serialized payload; because the plugin does not restrict which classes may be instantiated on deserialization, a gadget chain is triggered that writes an attacker-chosen file (e.g., a PHP web shell) and executes arbitrary code. Publicly available exploit code (referenced by WPScan) lowers the practical barrier. AC:H reflects the need for a viable gadget chain and an XML-RPC-reachable endpoint.