CVE-2026-87074: Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Forms WordPress pluginto a version that resolves this vulnerability.Fixed in 1.57.2.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can exploit it. The plugin provides the authorization token to the anonymous caller, and that token can be replayed without limit.
What does an attacker need to send emails through an affected site?
The attacker only needs to make requests to the affected Forminator Forms plugin. They can supply both an arbitrary recipient address and the link included in the notification message.
Are attacker-sent messages limited to a particular recipient or link?
No. The affected behavior accepts the recipient address and message link from the request, allowing messages to be sent to arbitrary addresses with attacker-controlled links.
How can this be mitigated if updating is not immediately possible?
The provided data does not specify a workaround. Updating Forminator Forms to version 1.57.2.1 or later is the identified remediation boundary.