rootpwn

low · CVSS v3 3.1 · EPSS 0.0018

CVE-2026-87069

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before run…

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
—
EPSS
0.0018

← All CVEs

Related CVEs

low

CVE-2026-84742

The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.

View analysis

low

CVE-2026-87074

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

View analysis

low

CVE-2026-93507

The WC Fields Factory WordPress plugin (v4.1.10 and earlier) fails to enforce proper access checks or nonce verification for post-cloning actions. This flaw allows users with Contributor or higher roles to duplicate any post, including private or draft content, and read the resulting copy. The vulnerability exposes sensitive content to unauthorized contributors.

View analysis

low

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.

View analysis