Forminator Forms CVE-2026-87069

Requires an authenticated WordPress account of any role, including a no-privilege Subscriber (PR:L). The site must be running a vulnerable Forminator Forms version (1.38.1 up to but not including 1.57.2.1) and must still be in the pre-migration state, because the vulnerable code is a ONE-TIME payment-field migration that runs during construction of a Forminator admin screen on any wp-admin request by a logged-in user - this one-shot, state-dependent nature is the primary limiting factor (reflected as AC:H) and means the window closes once the migration has run. No nonce, capability, or ownership check gates the action, so no CSRF token or admin capability is needed once a low-privilege session exists. Maximum leverage is realized on sites operating live Forminator payment forms.

This is a genuine but low-severity issue best treated as a hygiene/patch-hardening item rather than an urgent priority. The CVSS 3.1 base score of 3.1 (Low) reflects the vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N: network-reachable but requiring an existing authenticated account (PR:L, satisfiable by the lowest Subscriber role) and elevated attack complexity (AC:H) because the flaw is a ONE-TIME payment-field migration - it only fires while the plugin is in the pre-migration state, so the exploitable window is timing/state-gated rather than repeatable at will. Impact is integrity-only (I:L) with no confidentiality or availability effect, though the practical consequence - silently rewriting the saved field configuration of a live payment form - could be more damaging than I:L suggests if it can be steered to alter payment routing or field behavior. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; the combination of PR:L + AC:H + one-time window makes broad opportunistic exploitation unlikely. No SSVC decision data was supplied. Note a metadata conflict: the input Tag 'Authentication Bypass' is inaccurate - CWE-862 and the description confirm this is a missing-authorization flaw exploited by an already-authenticated user, not an authentication bypass.

An attacker holding (or self-registering) a low-privilege Subscriber account on a WordPress site running a vulnerable Forminator version logs into wp-admin and loads any admin screen. Because the unguarded one-time payment-field migration executes during that admin page's construction for any logged-in user, the attacker's request rewrites the saved field configuration of a live payment form. No public exploit code was identified at time of analysis; the one-time migration nature and AC:H mean the window is limited.