# CVE-2026-19221: Forminator Forms privilege escalation to network-wide RCE on multisite

Source: https://junglewise.ai/threats/cve-2026-19221-forminator-forms-privilege-escalation-to-network-wide-rce-on  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19221 · Severity: high · CVSS 7.2 · Published 2026-08-22

Forminator Forms is a WordPress form-builder plugin used on multisite installations. A flaw in how the plugin handles network-wide settings allows a single-site administrator to gain control over the entire WordPress network by installing and executing malicious code across all sites without needing network-level privileges or credentials.

Technologies: [WPMUDEV Forminator Forms](https://junglewise.ai/threats/technologies/forminator-forms). Vendors: [WPMUDEV](https://junglewise.ai/threats/vendors/wpmudev).

## Quick answers

**Is CVE-2026-19221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19221 being exploited in the wild.

**How severe is CVE-2026-19221?** High severity, with a CVSS score of 7.2, published 22 August 2026.

**Which products and versions are affected?** WPMUDEV Forminator Forms before 1.57.0.5.

**Is there a fix for CVE-2026-19221?** A patch was published on 2026-08-22: Fixed in version 1.57.0.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19221 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19221?** Check whether you run WPMUDEV Forminator Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a privilege escalation and arbitrary code execution flaw stemming from insufficient authorization checks on network-wide settings. A single-site administrator can exploit this by: (1) extracting a callback nonce from the plugin's hub connection screen, (2) setting a network-wide API key credential via an unauthenticated parameter, (3) using that credential to invoke a remote command channel (authenticated via HMAC-SHA256) that accepts plugin installation and activation requests, and (4) uploading and executing arbitrary PHP code across the entire network. The attack requires the plugin to be network-activated (the default for the free version) and the attacker to hold admin privileges on at least one site within the multisite network. No fix information beyond patching to version 1.57.0.5 or later is currently available.

## Affected products

- WPMUDEV Forminator Forms before 1.57.0.5

## Timeline

- 2026-08-20: disclosed
- 2026-08-22: advisory
- 2026-08-22: patched: Fixed in version 1.57.0.5

## References

- [https://wpscan.com/vulnerability/5aa85c72-2a60-4243-b370-ef0b46e98cfe/](https://wpscan.com/vulnerability/5aa85c72-2a60-4243-b370-ef0b46e98cfe/)

## Related threats

- [Forminator Forms arbitrary file deletion in uploads](https://junglewise.ai/threats/cve-2026-5461-the-forminator-forms-plugin-for-wordpress-is-vulnerable-to-limited)
- [Forminator Forms IP spoofing in poll voting and entry recording](https://junglewise.ai/threats/cve-2026-87070-the-forminator-forms-wordpress-plugin-before-1-57-2-1-does-not)