Forminator Forms EUVD-2026-64222

Exploitation requires that the attacker already holds a WordPress user account with sufficient privileges to create or edit Forminator Forms registration forms - this corresponds to a role that has been granted the plugin's form-management capability, typically Editor or a custom role, which maps to PR:H in the CVSS vector. The WordPress site must have user self-registration enabled (the default WordPress setting disables it). The specific Forminator Forms version must be below 1.57.0.7. What limits exploitation: the attacker cannot be unauthenticated; they must have a pre-existing elevated account on the target site. The malicious form must also be accessible to prospective registrants, meaning the attacker or a co-conspirator must share or embed it. Environments that restrict form-builder access to a small set of fully trusted admins, or that have user registration disabled site-wide, are not exploitable.

The CVSS 3.1 base score of 6.6 with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the two-stage nature of this vulnerability: the exploiting party must already hold high privileges (PR:H) to configure the malicious form, and the attack complexity is high (AC:H) because exploiting it requires deliberate misconfiguration rather than a single request. The downstream impact - any unauthenticated visitor becoming an administrator - is severe (C:H/I:H/A:H), but the high-privilege prerequisite substantially limits the realistic threat surface to insider threats, compromised form-builder accounts, or multi-tenant WordPress environments where sub-admin roles are loosely controlled. EPSS at 0.14% (4th percentile) corroborates low observed exploitation. KEV status is not present, and no POC has been identified. This is not a 'zero-click remote' scenario; it is a configuration-abuse path requiring an already-elevated actor. The real-world priority tier is moderate: environments where sub-admin users can create forms without oversight (agencies, shared hosting, multisite) carry the highest residual risk and should patch promptly, while single-operator sites with no delegated form-builder accounts face minimal exposure.

An attacker who holds a delegated WordPress account with form-building permissions - such as an agency employee, a compromised Editor account, or a rogue contractor - navigates to the Forminator Forms builder, creates or edits a registration form, and sets the default user role assigned upon registration to 'administrator.' The attacker then shares or embeds the registration form URL publicly. Any visitor who submits the form is granted full WordPress administrator access, allowing complete site takeover including content modification, credential harvesting, and plugin/theme installation. No public exploit code has been identified at time of analysis.