Description

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-26T06:16:25.703Z",
  "pubdate": "2026-08-26T06:16:25.703Z",
  "executiveSummary": "The Forminator Forms WordPress plugin contains a critical security vulnerability involving improper validation of site registration settings within a WordPress multisite environment.\nThe vulnerability type is categorized as an improper access control issue, specifically related to the bypass of network-wide registration restrictions.\nAffected systems are WordPress multisite installations running Forminator Forms versions prior to 1.57.1.\nThe risk implication is severe, as it allows unauthenticated, remote attackers to instantiate new sites on a WordPress multisite network without authorization.\nUpon successful exploitation, the attacker gains administrative privileges over the newly created site, potentially leading to full site takeover, arbitrary code execution via plugin/theme uploads, or malicious data exfiltration.\nThe primary requirement for exploitation is a misconfigured or default multisite environment where the plugin is active, combined with the lack of registration validation logic in the affected plugin versions.\nAttackers do not require pre-existing user accounts or administrative credentials, as the exploit targets the signup functionality directly.",
  "technicalDetails": "The root cause of this vulnerability lies in the Forminator Forms plugin's failure to perform a conditional check against the WordPress multisite 'registration' setting ('registration' option in the 'site' namespace) before processing site signup requests.\nIn a standard WordPress multisite configuration, site registration is typically controlled via the 'Allow new registrations' setting in the Network Admin dashboard. When this is disabled, the system should reject any attempts to create new sites. Forminator Forms, however, implements custom logic for site signup that bypasses this global validation check.\nThe attack flow initiates when an unauthenticated actor submits a crafted request to the Forminator signup endpoint. Because the plugin does not verify if the current network settings permit new site registration, the backend controller proceeds to initialize the site creation process regardless of the actual multisite network configuration.\nDuring the request processing, the plugin triggers internal functions responsible for creating the site entry in the database, generating the site URL, and assigning an initial user as the administrator. By manipulating the request parameters, the attacker can specify the site details and the administrator account credentials.\nThe vulnerable component is the site signup module within Forminator Forms. This module fails to invoke the necessary WordPress API checks—such as verifying the 'registration' option or ensuring that the request originates from a context where user signup is explicitly enabled—before executing the database write operations.\nSince the exploit does not require authentication, it is highly accessible via the public network. An attacker can use automated scripts to repeatedly interact with the signup endpoint to provision multiple sites or to target specific network subdomains.\nPost-exploitation, the attacker assumes the role of an Administrator on the newly created site. This allows the attacker to access the site's dashboard, manage plugins, upload custom themes, and modify site-specific settings. Within the context of a multisite network, this access can be a precursor to further lateral movement or privilege escalation if the site administrator can interact with network-wide resources or if the server environment is not sufficiently isolated (e.g., lack of file system permissions or dangerous PHP configurations).\nAffected versions are strictly limited to those released prior to 1.57.1, where the missing validation logic was officially addressed by the developers."
}