rootpwn

medium · CVSS v3 5.3

CVE-2026-87071

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply…

Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-84741

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.

View analysis

medium

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.

View analysis

medium

CVE-2026-86603

WP Recipe Maker plugin versions prior to 10.8.2 lack an authorization check on an AJAX endpoint, enabling any logged-in user to view unpublished recipe list IDs and titles. This flaw can expose sensitive content and user data. It affects sites running the vulnerable plugin.

View analysis

medium

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

View analysis