Role Validation Bypass in Forminator Forms Plugin by WP Rocket

CVE-2026-87068

What is CVE-2026-87068?

The Forminator Forms plugin prior to version 1.57.2.1 contains a significant vulnerability related to role validation. When a registration form is embedded within an imported quiz, the plugin fails to consistently enforce role validation. This flaw allows an individual importing quizzes to publish a registration form that unintentionally permits submissions from any user role, including administrative rights, thus posing a substantial security threat. Notably, the same registration form setup is denied through both the standard form editor and direct form imports, highlighting the inconsistent application of validation mechanisms.

References