Executive brief
Forminator Forms is a WordPress plugin for building and managing web forms. The plugin before version 1.57.2.1 has a flaw where it improperly deserializes data from XML-RPC requests, allowing authenticated users with form-management permissions to instantiate arbitrary PHP classes. An attacker can exploit this to write files to the server and execute arbitrary code, potentially compromising the entire WordPress installation.
Technical details
The vulnerability is a PHP object injection flaw in XML-RPC deserialization, classified as CWE-94 (Code Injection). Authenticated users holding the forms-management permission can craft malicious XML-RPC requests to instantiate arbitrary PHP classes, leading to remote code execution via file write. The permission is granted to administrators by default and may be delegated to lower-privileged roles through the plugin's settings, making exploitation possible on sites using custom role configurations.
Affected products
- wpdev Forminator Forms before 1.57.2.1
Timeline
- 2026-09-18: disclosed
- 2026-09-20: advisory