CVE-2026-87067 Details
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
A remote code execution vulnerability has been identified in the Forminator Forms WordPress plugin, affecting versions prior to 1.57.2.1. The issue arises from the plugin's failure to restrict which classes can be instantiated during the deserialization of values from XML-RPC requests. This flaw allows users with forms-management permission to write arbitrary files and execute code of their choice. By default, this permission is granted to administrators, but it can also be assigned to other roles through the plugin's settings, making the vulnerability accessible to non-admin users on such sites.
Users are advised to update the Forminator Forms WordPress plugin to version 1.57.2.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 20, 2026CISA-ADP
Assessed Sep 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Forminator Forms | < 1.57.2.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 20, 2026 | CVE Modified | CISA-ADP |
| Sep 20, 2026 | New CVE Received | [email protected] |