CVE-2026-87074
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
- State
- Published
- Severity
- 3.7 Low
- Published
- Sep 23, 2026
- Updated
- Sep 23, 2026
- Reserved
- Sep 8, 2026
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Forminator FormsUnknown |
|
References
- https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.