What’s Vulnerable › Vulnerabilities
CVE-2026-87069: Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
- Severity: low (CVSS 3.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-23 · updated 2026-09-23
- Weakness: CWE-862
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
Affected products
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder: from 1.38.1 before 1.57.2.1 — fixed in 1.57.2.1
How to fix
Upgrade to a fixed version: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder 1.57.2.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-87069 or the next vulnerability affects your stack