CVE Feed

    Dashboard / CVE / CVE-2026-87074

    CVE-2026-87074

    The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

    Published:Sep 23, 2026
    Last Modified:Sep 28, 2026
    EPS:Sep 23, 2026
    EPSS Score:0.00154
    CVSS Score:3.7

    Affected Products

    Vendor
    Wordpress-extensions
    Product
    Forminator Forms

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-97638 (CVSS 7.5) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-5461 (CVSS 6.5) — The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and in…
    CVE-2026-103911 (CVSS 6.5) — The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable…
    CVE-2026-101335 (CVSS 6.5) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-92144 (CVSS 7.2) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-85235 (CVSS 7.2) — The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to …
    CVE-2026-87071 (CVSS 5.3) — The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission …
    CVE-2026-87070 (CVSS 5.3) — The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy…
    CVE-2026-87069 (CVSS 3.1) — The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check…
    CVE-2026-87068 (CVSS 6.6) — The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewher…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High