WordPress Plugin Vulnerabilities

Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

Description

The plugin does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.

Proof of Concept

Affects Plugins

Plugin icon
forminator
Fixed in 1.57.1

References

CVE
CVE-2026-19220

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://jakubherman.net
Verified
Yes
WPVDB ID
99e2a045-15cb-4c58-8090-1f92474f6485

Timeline

Publicly Published
2026-08-24 (about 3 days ago)
Added
2026-08-24 (about 2 days ago)
Last Updated
2026-08-24 (about 2 days ago)

Other

Published
Title
Published
2026-06-16
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.1.1 - Subscriber+ Privilege Escalation
Published
2026-04-10
Title
BuddyPress Groupblog < 1.9.4 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Group Blog IDOR
Published
2025-12-11
Title
Comments – wpDiscuz < 7.6.40 - Unauthenticated Account Takeover
Published
2026-08-07
Title
AI Copilot – Content Generator < 1.5.8 - Unauthenticated Privilege Escalation via Custom Workflow Route
Published
2025-10-02
Title
Spirit Framework < 1.2.15 - Account Takeover and Privilege Escalation