Executive brief
Forminator Forms, a WordPress plugin for building web forms, contains a flaw that allows users with quiz import permissions to secretly publish registration forms that grant administrator access to anyone submitting them. This bypasses the security checks the plugin applies to forms created through normal channels, enabling unauthorized privilege escalation and account takeover for attackers.
Technical details
The plugin fails to enforce role validation on registration forms nested inside imported quizzes, unlike the validation it applies to forms created via the standard editor or form import. An authenticated attacker with quiz import privileges can craft and import a malicious quiz containing a registration form that assigns arbitrary roles—including administrator—to form submissions. The vulnerability affects versions before 1.57.2.1 and requires authentication and user interaction (quiz import), with the published form being publicly accessible.
Affected products
- WP Forminator Forminator Forms before 1.57.2.1
Timeline
- 2026-09-18: disclosed
- 2026-09-20: patched: Fixed in version 1.57.2.1