CVE-2026-87074 Details
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
A vulnerability exists in the Forminator Forms WordPress plugin in versions prior to 1.57.2.1. The issue arises because the plugin does not associate saved-draft notifications with the user who created the draft. Instead, it retrieves both the recipient email address and any links included in the message from the request. This flaw allows unauthenticated users to send emails using the site's mail configuration to any address, including a link of their choice, formatted within the site's template. The authorization token needed to send these emails is provided to anonymous users by the plugin itself and can be reused indefinitely.
Users are advised to update the Forminator Forms WordPress plugin to version 1.57.2.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Forminator Forms | < 1.57.2.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |