CVE-2026-87071: unknown forminator forms Improper Input Validation
Vulnerability summary
CVE-2026-87071 is a medium (CVSS 5.3) Improper Input Validation vulnerability in unknown forminator forms. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.6% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.57.2.1.
Timeline
- 23-09-2026PublishedVulnerability first disclosed.
- 23-09-2026Last modifiedVulnerability information updated.
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.19%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- forminator forms< 1.57.2.1
Wordpress1 product
- forminator≤ 1.57.2.0 (fixed in 1.57.2.1)
2 vendors · 2 products