CVE Feed

    Dashboard / CVE / CVE-2026-87069

    CVE-2026-87069

    The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

    Published:Sep 23, 2026
    Last Modified:Sep 28, 2026
    EPS:Sep 23, 2026
    EPSS Score:0.00133
    CVSS Score:3.1

    Affected Products

    Vendor
    Wordpress-extensions
    Product
    Forminator Forms

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-97638 (CVSS 7.5) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-5461 (CVSS 6.5) — The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and in…
    CVE-2026-103911 (CVSS 6.5) — The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable…
    CVE-2026-101335 (CVSS 6.5) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-92144 (CVSS 7.2) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-85235 (CVSS 7.2) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-87071 (CVSS 5.3) — The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission …
    CVE-2026-87070 (CVSS 5.3) — The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy…
    CVE-2026-87074 (CVSS 3.7) — The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visit…
    CVE-2026-87068 (CVSS 6.6) — The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewher…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High