Description

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-09-20T07:16:50.643Z",
  "pubdate": "2026-09-20T07:16:50.643Z",
  "executiveSummary": "The Forminator Forms WordPress plugin contains a critical privilege escalation vulnerability due to improper input validation during the processing of nested registration forms within imported quizzes.\nThe vulnerability occurs because the plugin fails to enforce standard role-based access control (RBAC) checks when a registration form is encapsulated within a quiz object.\nThis flaw allows an authenticated user with limited permissions—specifically those authorized to import quizzes—to circumvent security constraints that would otherwise block the creation or publication of forms granting elevated privileges.\nBy leveraging this vector, an attacker can publish a publicly accessible registration form configured to assign any user role, including the 'administrator' role, upon submission.\nThe impact is a full site compromise, as unauthorized individuals can register new accounts with administrative privileges. The vulnerability is present in versions prior to 1.57.2.1.\nSuccessful exploitation requires the attacker to have the ability to import quizzes, moving the attack surface from the restricted form editor interface to the less-restricted quiz import functionality.",
  "technicalDetails": "The root cause of this vulnerability lies in an inconsistency in security middleware implementation within the Forminator Forms plugin. While the standard form editor and direct form import mechanisms implement strict role validation checks to prevent unauthorized users from configuring forms that assign sensitive roles (such as 'administrator'), these validations are omitted when a form is processed as a nested entity within an imported quiz.\nIn the standard workflow, the plugin evaluates the user's capabilities before allowing the configuration of form fields related to user registration and role assignment. When a quiz is imported, the plugin's parsing logic treats the nested form definition as part of the quiz object. The validation logic responsible for verifying if the user has the authority to assign roles during form creation is not triggered in this code path.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious JSON file representing a quiz that embeds a registration form. Within the configuration data for this registration form, the attacker specifies that new users should be assigned the 'administrator' role upon submission. Second, the attacker utilizes the legitimate quiz import functionality provided by the plugin to upload the crafted file. Because the validation check is bypassed, the plugin successfully parses the file and registers the form as an active, public-facing entity.\nOnce the quiz containing the malicious registration form is published, it becomes publicly reachable. Any visitor to the site who interacts with the form and completes the registration process is granted the role defined in the malicious configuration. This bypasses both the user interface restrictions and the backend security checks designed to prevent non-administrative users from elevating privileges.\nThe vulnerability highlights a failure to maintain a consistent security policy across different entry points of the application. Even though the same registration form configuration would be rejected if processed through the standard form editor, the nested context creates an 'authority illusion' where the plugin fails to enforce the principle of least privilege. Post-exploitation, the attacker gains a persistent administrative foothold, allowing for complete control over the WordPress environment, including data exfiltration, theme or plugin manipulation, and remote code execution through administrative capabilities."
}