Security Alert Summary
The Forminator Forms plugin (versions prior to 1.57.2.1) allows unauthenticated form submitters to supply arbitrary post metadata. Public forms that accept post content can be used by anonymous visitors to attach metadata keys of their choosing to posts created by those submissions.
CVE Details
- CVE ID: CVE-2026-87071
- Affected component: Forminator Forms WordPress plugin
- Affected versions: versions prior to 1.57.2.1
- Published: September 23, 2026 at 11:17:15 AM UTC
- Last modified: September 23, 2026 at 11:17:15 AM UTC
- CVSS v3.1: Base score 5.3, Medium —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / Privileges / User interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness: CWE-20 (Improper Input Validation)
Technical Details
According to the vulnerability description, Forminator Forms before 1.57.2.1 does not restrict which metadata keys a form submission may supply and does not exclude keys that WordPress reserves for its own use. As a result, an unauthenticated visitor submitting a public form that collects post content can attach arbitrary metadata keys and values to the post created by that submission.
The underlying issue is a lack of validation or a whitelist for allowed post meta keys when processing public form submissions. No specific plugin functions or REST API endpoints are named in the provided data.
The primary technical impact is integrity-related: attacker-controlled metadata can be attached to posts. If a site, theme, or other plugins read and act on post meta without further validation, attacker-supplied meta could influence how posts are presented or processed. The CVSS assessment indicates no direct confidentiality or availability impact from this issue.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, internal editorial staff, and external contributors who use a public form to submit draft posts. An unauthenticated attacker could submit a form that creates a post and includes arbitrary post meta. Depending on how your site and plugins use post meta, that attacker-controlled metadata could alter post behavior or display. For example, if a theme or plugin exposes certain meta fields in the frontend, attacker-supplied values could appear to site visitors or be used in automated processes.
The CVSS data indicates confidentiality impact is none, but if your site design stores or displays contact information, user roles, or other sensitive data in post metadata, attacker-controlled meta values could lead to unintended disclosure or enable targeted social engineering. This increases risk for targeted phishing or other forms of social manipulation, especially where staff or contributors rely on post content for communications.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and post-creation logs for unusual behavior or unexpected metadata values.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
