CVE-2026-87067
8.5 HIGHPublished 2026-09-20 · Updated 2026-09-21
AI risk analysis
- Summary
- The flaw allows users with forms-management permissions to execute arbitrary code by deserializing a value from an XML-RPC request, posing a high risk due to the broad permissions associated with this role.
- Exploitability
- Exploitation is relatively straightforward for attackers who can send a crafted XML-RPC request, requiring the target to have the forms-management permission, typically held by administrators.
- Blast radius
- If exploited, the issue could lead to full compromise of the WordPress site, including data theft, unauthorized code execution, and potential propagation to other sites managed by the same user.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Forminator Forms 1.57.2.1 or later.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
References
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.