CVE-2026-87069

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1

Description The plugin fails to perform a nonce, capability, or ownership check before executing a one-time payment-field migration during the construction of an admin screen. This process occurs on every wp-admin request for any logged-in user. Consequently, any authenticated user, including those with Subscriber roles and no specific permissions within the plugin, can rewrite the saved field configuration of any form on the site, including active payment forms. A nonce is a unique token used to protect against cross-site request forgery (CSRF) attacks.

Recommendations Update Forminator Forms WordPress plugin to version 1.57.2.1 or later.