CVE-2026-87070: unknown forminator forms Use of Less Trusted Source

Vulnerability summary

CVE-2026-87070 is a medium (CVSS 5.3) Use of Less Trusted Source vulnerability in unknown forminator forms. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.7% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.57.2.1.

Timeline

1. 23-09-2026
   PublishedVulnerability first disclosed.
2. 23-09-2026
   Last modifiedVulnerability information updated.

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
• CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.