EUVD-2026-83671
GHSA-xq3c-rrxv-22rc
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attacker fully controls the crafted quiz (AC:L); a delegated non-admin quiz-importer is the exploiting actor (PR:L, not PR:H); administrator-role grant yields full C/I/A compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
AnalysisAI
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated user who holds the delegated capability to import Forminator quizzes but is NOT a full administrator (an admin would need no exploit). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine privilege-escalation-to-site-takeover flaw whose real-world priority is meaningfully higher than the vendor's 6.6 CVSS suggests, but is bounded by who can trigger it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading Forminator Forms to version 1.57.2.1 or later; this is the primary and definitive fix and the only version boundary identified in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator Forms
View allAuthenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthoriz
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cro
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Repl
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure D
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today