Executive brief
Forminator Forms is a WordPress plugin for creating polls and forms. The plugin fails to validate that requests originate from trusted sources before accepting client-supplied IP addresses. This allows unauthenticated attackers to bypass per-visitor voting limits on polls and submit multiple entries while spoofing their IP address, undermining the integrity of polls and entry tracking.
Technical details
The vulnerability stems from improper trust of client-supplied forwarding headers (such as X-Forwarded-For) without verifying the request comes from a trusted proxy. The plugin uses this untrusted IP value both to enforce per-visitor poll voting limits and to record the visitor's address in form submissions. An unauthenticated attacker can forge these headers to bypass voting restrictions and control the recorded IP address for each submission.
Affected products
- WPMUDEV Forminator Forms before 1.57.2.1
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fix available in version 1.57.2.1