CVE-2026-87070
Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Reserved
- Sep 8, 2026
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | WPScan |
Weaknesses
- CWE-348 Use of Less Trusted Source
Affected Products
| Product | Versions |
|---|---|
Forminator FormsUnknown |
|
References
- https://wpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.