CVE-2026-87070
5.3 MEDIUMPublished 2026-09-23 · Updated 2026-09-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-348
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100653PoC
- MEDIUMCVE-2026-101277
- MEDIUMCVE-2026-102275PoC
- MEDIUMCVE-2026-102630PoC
- CRITICALCVE-2026-61682PoC
- MEDIUMCVE-2026-62987PoC
- MEDIUMCVE-2026-80514
- MEDIUMCVE-2026-84718
Related by shared AI tags and CWE weakness class. Browse the full archive.