CVE-2026-19222: Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/forminator-formsto a version that resolves this vulnerability.Fixed in 1.57.0.7
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who is permitted to build Forminator registration forms can configure a form that assigns the administrator role. Any visitor who registers through that form can then receive that role.
Are sites affected by default?
The issue requires a user with permission to build forms to create or modify a registration form with an administrator role assignment. The provided information does not establish that a default form configuration is vulnerable.
How can I check whether my site may already be affected?
Review Forminator registration forms and identify any configured to assign the administrator role. Also review administrator accounts created through registration forms, particularly those created by visitors.
What should be done if updating is not immediately possible?
Restrict who can build or modify Forminator forms, and review or disable registration forms that could assign the administrator role. Remove or investigate administrator accounts created through such forms.