CVE-2026-19222
Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass
- State
- Published
- Severity
- 6.6 Medium
- Published
- Aug 22, 2026
- Updated
- Aug 23, 2026
- Reserved
- Aug 7, 2026
Description
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.6 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
Forminator FormsUnknown |
|
References
- https://wpscan.com/vulnerability/bb3997c6-4d9a-46f6-85d7-d472dfc00829/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.