Executive brief
Forminator Forms, a WordPress plugin for building and managing web forms, allows unauthenticated visitors to inject arbitrary metadata into posts created by public form submissions. An attacker can exploit this vulnerability by submitting a form designed to create posts and attaching malicious metadata, potentially modifying post properties, corrupting data, or escalating privileges through WordPress reserved metadata keys.
Technical details
The plugin fails to validate or restrict metadata keys supplied in form submissions, and does not filter WordPress-reserved metadata keys. An unauthenticated attacker can submit a public form configured to create posts and inject arbitrary post metadata via request parameters, allowing modification of post properties without authorization. The vulnerability requires a public form configured to create posts but has no authentication or user interaction barriers beyond form submission.
Affected products
- Forminator Forminator Forms before 1.57.2.1
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Fixed in version 1.57.2.1