CVE-2026-87071: Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Formsto a version that resolves this vulnerability.Fixed in 1.57.2.1
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using a Forminator Forms version earlier than 1.57.2.1 are exposed when they have a public form that accepts unauthenticated submissions and creates a post from submitted content.
What does an attacker need to exploit it?
An attacker only needs network access to the public form. No WordPress account, prior privileges, or user interaction is required.
What can an attacker change through a vulnerable form?
They can supply arbitrary post metadata keys and values for the post created by their submission, including metadata keys reserved by WordPress.
How can I determine whether my site may already be affected?
Review posts created through public Forminator Forms submissions and inspect their post metadata for unexpected keys or values. Also identify forms that collect post content and allow unauthenticated visitors to submit them.
What can be done before updating?
Restrict or disable unauthenticated access to Forminator forms that create posts, or remove their ability to collect post content, until the plugin can be updated to 1.57.2.1 or later.