Forminator Forms CVE-2026-87070

No special conditions or authentication are required - remote unauthenticated exploitation against default configurations of the Forminator Forms WordPress plugin before 1.57.2.1, which unconditionally prefers client-supplied forwarding headers (e.g. X-Forwarded-For) over the real connecting address without verifying the request came from a trusted proxy. Practical limits: to abuse the voting-limit bypass the site must actually host a Forminator poll/voting form, and to forge stored data the attacker only needs any reachable Forminator submission endpoint. Impact is bounded to poll-result manipulation and falsified submitter-address records; there is no code execution, no data disclosure, and no availability impact. Sites that terminate and normalize forwarding headers at a properly configured upstream proxy reduce but do not eliminate the abuse of the attacker-controlled header value reaching the plugin.

This is a genuine but low-severity business-logic and data-integrity flaw, not a system-compromise issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 Medium) correctly reflects a remotely reachable, unauthenticated, low-complexity weakness with no impact to availability. A publicly available exploit exists (WPScan), so exploitation is trivial where a vulnerable Forminator poll or form is exposed - but publicly available exploit code exists is distinct from active exploitation: there is no CISA KEV listing and no EPSS score in the provided data, so real-world exploitation is unproven and this should be treated as opportunistic/nuisance abuse rather than a targeted-compromise priority. The core signal conflict worth flagging: the vendor scored C:L (confidentiality) and the tag says Information Disclosure, but the described impact - voting without limit and choosing the address recorded against every submission - is an INTEGRITY problem (data/result manipulation and log/attribution spoofing), not a confidentiality leak; the C:L rating is difficult to justify from the description. No CVSS attack requirement or scope change is involved. Overall: real, easily exploitable, but bounded impact (poll-result skewing and forged submitter IPs), making it a low-to-moderate remediation priority best resolved by upgrading to 1.57.2.1.

An unauthenticated attacker targets a WordPress site running a Forminator poll and repeatedly submits votes while rotating a spoofed X-Forwarded-For header, bypassing the per-visitor limit to arbitrarily inflate or skew poll results. On form submissions, the attacker sets the forwarding header to any chosen value so the address stored against each entry is falsified, poisoning audit/attribution records. A public exploit is available via WPScan, lowering the skill required to weaponize this.