Forminator Forms CVE-2026-87074

Requires a target site running Forminator Forms before 1.57.2.1 with a form that has the save-and-continue (saved draft) feature enabled AND a saved-draft notification email configured - this is a non-default configuration and is the primary limiting factor. Given that configuration, no authentication and no user interaction are needed (PR:N/UI:N): the plugin hands the send-authorizing token to the anonymous caller, and both the recipient address and the in-message link are taken from the request, allowing unlimited replay. AC:H reflects that the vulnerable draft-notification flow must exist and be reachable; impact is bounded to attacker-controlled outbound email (integrity), not data theft or service disruption.

This is a genuinely low-severity, abuse-of-functionality issue rather than a system-compromise flaw, and the signals are internally consistent. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N = 3.7) correctly reflects that an unauthenticated remote attacker can trigger it but only achieves a limited integrity impact (I:L) - the site sending an attacker-controlled email - with no confidentiality or availability effect. AC:H is reasonable because exploitation depends on a non-default feature (saved-draft / save-and-continue notifications being enabled and configured on a Forminator form). No EPSS score, KEV listing, or POC is present in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' The real-world danger is reputational/phishing-relay rather than server compromise: because the message goes out from the site's own mail configuration and inside the site's own trusted template, it lends credibility to attacker-chosen phishing links and can consume the site's mail-sending reputation (blacklisting, deliverability damage). The CWE (CWE-862 missing authorization) aligns with the description that the send-token is handed to the anonymous caller and replayable without limit. Net: low priority for most defenders on CVSS grounds, but worth prioritizing for sites that (a) run Forminator with draft notifications and (b) care about brand/mail-domain reputation, since the flaw enables scalable, replayable spam/phishing from a trusted sender.

An attacker interacts with a public Forminator form that has save-and-continue drafts and draft-notification emails enabled, obtains the send-authorizing token the plugin itself returns to the anonymous caller, then replays the request supplying an arbitrary recipient address and an attacker-chosen link. The victim's WordPress site then emails a phishing link - wrapped in the site's own trusted template and sent from the site's own mail configuration - to any address, repeatedly and without rate limiting. No POC is referenced in the available data.