Description

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-20T12:16:32.670Z",
  "pubdate": "2026-08-20T12:16:32.670Z",
  "executiveSummary": "An unauthenticated PHP Object Injection vulnerability has been identified in the Forminator plugin affecting versions up to 1.57.0. This critical security flaw allows remote, unauthenticated attackers to supply maliciously crafted serialized data to vulnerable endpoints within the plugin.\nThe primary impact of this vulnerability involves potential security degradations depending on the presence of compatible gadget chains within the application environment, which may lead to remote code execution, arbitrary file manipulation, or denial of service conditions.\nThe affected product is the Forminator plugin across all versions <= 1.57.0. The risk implications are severe due to the lack of authentication requirements, allowing any network-adjacent or remote attacker to initiate exploitation attempts without prior access credentials.\nSuccessful exploitation requires the target system to process untrusted serialized input improperly and necessitates that the application context includes suitable gadget classes. Remediation requires updating the Forminator plugin beyond version 1.57.0 or applying vendor-supplied patches immediately.",
  "technicalDetails": "The vulnerability stems from insecure deserialization practices within the Forminator plugin up to version 1.57.0. The root cause is the handling and processing of user-supplied input without proper sanitization or validation prior to passing it to unsafe deserialization functions such as unserialize().\nAttackers can leverage this flaw by sending a specially crafted HTTP request containing malicious serialized PHP objects to the vulnerable network endpoints exposed by Forminator. Because the vulnerability is unauthenticated, no session tokens, privileges, or API keys are required to transmit the payload.\nThe step-by-step attack flow begins with the attacker identifying the vulnerable endpoint exposed by the Forminator plugin over the network. The attacker constructs a serialized payload containing specific PHP gadget chains designed to trigger unintended method calls, such as __wakeup() or __destruct(), upon deserialization.\nUpon receipt of the malicious payload, the vulnerable component in the Forminator plugin processes the input and executes the unserialize() function on the untrusted data. This instantiates the serialized objects and executes the embedded gadget chain within the application context.\nDepending on the classes available in the PHP object scope and the loaded libraries (gadget chains), post-exploitation impact can range from arbitrary file deletion, information disclosure, Server-Side Request Forgery (SSRF), to full Remote Code Execution (RCE) under the privileges of the web server user.\nThe network exposure is broad, as the vulnerable endpoints are typically accessible via standard HTTP/HTTPS protocols without authentication constraints. Affected versions strictly encompass Forminator 1.57.0 and all prior iterations containing the flawed input handling mechanism."
}