Arbitrary Code Execution Vulnerability in Forminator Forms Plugin for WordPress
CVE-2026-87067
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 20 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87067?
The Forminator Forms WordPress plugin prior to version 1.57.2.1 allows privileged users to instantiate arbitrary classes by deserializing values from XML-RPC requests. This issue can lead to arbitrary code execution, as it permits these users, typically even those below the administrator level, to write files of their choice on the server. The vulnerability stems from insufficient restrictions on class instantiation during the deserialization process, posing significant security risks if exploited.
Affected Version(s)
Forminator Forms 1.57.0.7 < 1.57.2.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.