CVE-2026-87074

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1

Description The plugin fails to bind saved-draft notifications to the visitor who created the draft. It accepts both the recipient address and the link included in the message directly from the request. This allows unauthenticated visitors to force the site to send messages from its own mail configuration to any arbitrary address, including a link of the attacker's choice within the site's template. Additionally, the authorization token for sending is provided to the anonymous caller by the plugin and can be replayed without limit.

Recommendations Update Forminator Forms WordPress plugin to version 1.57.2.1 or later.