What’s Vulnerable › Vulnerabilities
CVE-2026-87067: Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
- Severity: high (CVSS 8.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-20 · updated 2026-09-21
- Weakness: CWE-94
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
Affected products
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder: from 1.57.0.7 before 1.57.2.1 — fixed in 1.57.2.1
How to fix
Upgrade to a fixed version: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder 1.57.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87067 or the next vulnerability affects your stack