Code Execution Vulnerability in Forminator Forms Plugin by WordPress
CVE-2026-19221
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19221?
The Forminator Forms plugin for WordPress, prior to version 1.57.0.5, exposes a critical weakness that allows any site administrator within a multisite network to execute arbitrary code. This occurs due to the improper restriction of a network-wide setting, thereby enabling potential malicious actions across the entire network. Site admins should immediately consider updating their plugin version to mitigate this risk.
Affected Version(s)
Forminator Forms 1.40.0 < 1.57.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.