Forminator Forms CVE-2026-87068

Requires an authenticated user who holds the delegated capability to import Forminator quizzes but is NOT a full administrator (an admin would need no exploit). Exploitation is specific to the quiz-import code path: the registration form must be nested inside an imported quiz, because the role validation Forminator enforces in the ordinary form editor and ordinary form import is not applied there. The registration form must be configured to assign a role (e.g. administrator) on submission and then reach a published, publicly reachable state. Limiting factors: the attacker must already have quiz-import rights (non-default for low-privilege users), and only Forminator versions 1.57.0 through before 1.57.2.1 are affected; the identical form is rejected via the two ordinary paths, so the nested-quiz vector is the only route.

This is a genuine privilege-escalation-to-site-takeover flaw whose real-world priority is meaningfully higher than the vendor's 6.6 CVSS suggests, but is bounded by who can trigger it. The vendor vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H yields 6.6 largely because PR:H and AC:H drag the score down. I dispute both: the entire premise is that a NON-admin user with delegated quiz-import capability - who is explicitly refused this via the ordinary form editor and ordinary form import - can nonetheless do it by nesting a registration form inside an imported quiz, so this is a delegated lower-privileged actor escalating (PR:L is more honest than PR:H; a real admin would need no exploit). AC is also more L than H because the attacker fully controls crafting the malicious quiz. My independent assessment is ~8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H): full C/I/A compromise via administrator role grant. Exploitation signals: publicly available exploit code exists (WPScan), and a patch is available (1.57.2.1). No EPSS score and no CISA KEV entry are provided, so there is no evidence of active exploitation - POC availability is a distinct, lower signal than confirmed in-the-wild use. Net: prioritize patching because a working POC plus site-takeover impact plus a popular plugin is an attractive target, even though exploitation requires a user who already holds delegated quiz-import rights.

An attacker holding a delegated, non-administrator role that includes the capability to import Forminator quizzes crafts a quiz export that hides a registration form configured to assign the administrator role on submission, then imports it - bypassing the role validation that would reject the same form in the normal editor or normal import. The now-live, publicly reachable form is submitted (by the attacker themselves or any visitor) and grants administrator, yielding full site takeover. Public exploit code exists (WPScan).