Description

Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-09T10:16:44.730Z",
  "pubdate": "2026-10-09T10:16:44.730Z",
  "executiveSummary": "This vulnerability is an authentication bypass via identity spoofing affecting the WPMU DEV Forminator plugin.\nThe flaw allows unauthorized actors to impersonate other users or entities within the form submission process.\nAffected versions range from n/a through 1.57.2.\nThe risk implication is significant as it compromises the integrity and authenticity of data submitted through Forminator forms.\nAn attacker can leverage this vulnerability to bypass standard authentication controls and submit malicious or fraudulent data while appearing as a different, potentially privileged, user.\nThis vulnerability does not appear to require complex exploitation conditions, potentially allowing for remote exploitation by unauthenticated or low-privileged users, depending on the form's configuration.",
  "technicalDetails": "The vulnerability resides within the WPMU DEV Forminator plugin, specifically impacting the logic governing identity verification during form submission processing.\nThe root cause is an improper implementation of identity validation mechanisms, which fails to securely bind a form submission to the authenticated user's session or identity.\nBy manipulating specific parameters within the submission request, an attacker can effectively perform identity spoofing, causing the application to associate the form submission with an identity other than the one intended by the system.\nThe attack flow generally involves the interception or manual crafting of HTTP POST requests destined for the Forminator submission endpoint.\nThe attacker modifies fields responsible for user identification—such as user IDs, email addresses, or session tokens—that the plugin relies upon without adequate server-side validation or cryptographic verification.\nUpon receiving the malformed request, the vulnerable component fails to re-authenticate or verify the authenticity of the claimed identity against the actual session state of the user.\nThis results in the application accepting the submitted data as if it were initiated by the spoofed user entity.\nThe impact of this exploit extends beyond mere data integrity issues; it can facilitate the bypass of access control mechanisms where form submissions trigger downstream actions based on the submitter's identity or role.\nFor instance, if the plugin is configured to grant specific permissions or initiate workflows based on the user submitting the form, an attacker could manipulate these outcomes by spoofing a high-privileged user account.\nFurthermore, this vulnerability allows for the submission of fraudulent data that is cryptographically or logically untraceable to the true source, potentially bypassing audit logs or spam filtering mechanisms that rely on user reputation or identity verification.\nThe vulnerability is present in all versions from n/a up to and including 1.57.2."
}