CVE-2026-87067

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1

Description An issue exists during the deserialization of values from XML-RPC requests where the plugin fails to restrict which classes can be instantiated. This allows users with forms-management permissions to write arbitrary files and execute arbitrary code. While administrators hold this permission by default, it can be granted to other roles through the plugin settings, expanding the potential attack surface.

Recommendations Update Forminator Forms WordPress plugin to version 1.57.2.1 or later.