CVE-2026-87067: Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Forms WordPress pluginto a version that resolves this vulnerability.Fixed in 1.57.2.1 - Compensating control
If you cannot immediately upgrade, restrict access to the Forminator Forms forms-management permission (admin actions) so only trusted users/roles can submit the XML-RPC request path that triggers the PHP object injection.
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An attacker must be authenticated with the Forminator Forms forms-management permission. Administrators have this permission by default, but lower-privileged roles can also exploit it if the plugin's settings have granted them that permission.
Are sites using default role permissions exposed to non-administrator attackers?
By default, the relevant permission belongs to administrators. Non-administrator exposure depends on whether the site has delegated the Forminator Forms forms-management permission to another role.
What can a successful attacker do?
A permitted attacker can cause arbitrary classes to be instantiated through a crafted XML-RPC value, write a file of their choosing, and execute arbitrary code.