Skip to content
fr Sign in
7.2 High

CVE-2026-19221 The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network…

Description

The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Affected products and versions

Product Affected versions Fixed in
Forminator Forms 1.40 1.40.0 → < 1.57.0.5 1.57.0.5

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Forminator Forms

The 10 CVEs of Forminator Forms →
CVE-2026-87071 The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may… 5.3 Medium CVE-2026-87070 The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before… 5.3 Medium CVE-2026-87074 The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who… 3.7 Low CVE-2026-87069 The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before… 3.1 Low
Track this CVE