Description

The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-22T06:16:16.130Z",
  "pubdate": "2026-08-22T06:16:16.130Z",
  "executiveSummary": "A privilege escalation vulnerability exists within the Forminator Forms WordPress plugin before version 1.57.0.5, specifically involving improper access control over network-wide administrative configurations in a WordPress multisite environment.\nThe vulnerability allows an authenticated attacker holding standard administrator privileges on any single, isolated sub-site within a WordPress multisite network to modify global settings intended exclusively for network-wide administrators.\nSuccessful exploitation of this security flaw grants the sub-site administrator the capability to execute arbitrary code across the entire multisite network, leading to complete infrastructure compromise.\nThe root cause stems from a failure to adequately validate and restrict administrative boundaries, permitting localized privilege escalation to a global network scope.\nGiven that an attacker requires existing sub-site administrative privileges to initiate the attack flow, the primary risk involves insider threats, compromised sub-site accounts, or lateral movement within a shared hosting deployment.\nImmediate remediation requires updating the Forminator Forms plugin to version 1.57.0.5 or later, where proper authorization checks are enforced to restrict network-wide settings exclusively to network administrators.",
  "technicalDetails": "The Forminator Forms WordPress plugin before version 1.57.0.5 suffers from an authorization bypass and broken access control vulnerability operating within WordPress multisite network architectures.\nThe vulnerable component resides in the plugin's authorization logic handling administrative options and settings that dictate global execution capabilities.\nIn a standard WordPress multisite installation, administrative roles are segregated into site administrators (managing a single sub-site) and network administrators (super admins managing the entire network).\nThe root cause of the vulnerability is the improper restriction of network-wide settings, failing to verify whether the requesting user possesses super administrator privileges before processing configuration updates.\nPrivilege requirements and authentication necessitate that the malicious actor possesses valid credentials for a sub-site administrator role, granting them access to the plugin's administrative dashboard interface.\nThe attack flow proceeds as follows: First, the authenticated sub-site administrator navigates to the Forminator Forms management interface. Second, the user interacts with configuration parameters or form features designed to persist settings globally across the network. Third, due to the missing authorization validation on the backend endpoint processing these requests, the plugin accepts the configuration changes submitted by the sub-site administrator.\nBy manipulating these network-wide settings, the attacker can leverage plugin features—such as custom code execution vectors, file uploads, or database operations—to inject and execute arbitrary code payloads.\nThe post-exploitation impact spans the entire network, allowing the attacker to compromise all other sub-sites, access sensitive database contents, or achieve remote code execution on the underlying web server hosting the WordPress multisite installation."
}