Auth bypass in Forminator Forms

CVE-2026-87069

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

Vulnerability class: Broken Access Control

Published · last modified .

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.002 (7.9th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 7.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

  • Forminator Forms

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-87069?
CVE-2026-87069 is a low-severity vulnerability in Forminator Forms, classified under Missing Authorization. CVSS score: 3.1/10. Published 2026-09-23.
How severe is CVE-2026-87069?
Low severity. CVSS v3 base score is 3.1 out of 10.