CVE-2026-6222 Overview
CVE-2026-6222 is a missing authorization vulnerability [CWE-862] in the Forminator Forms plugin for WordPress, affecting all versions up to and including 1.51.1. The flaw resides in the processRequest() method of the Forminator_Admin_Module_Edit_Page class. The method dispatches sensitive module-management actions after only a nonce check, without verifying the manage_forminator_modules capability. Authenticated users with subscriber-level access can export form configurations, delete modules, delete submissions, clone modules, or change publish/draft status on arbitrary forms, polls, and quizzes.
Critical Impact
Authenticated low-privilege users can exfiltrate form configurations containing integration credentials and notification routing, and destructively manipulate modules across the site.
Affected Products
- Forminator Forms plugin for WordPress, versions up to and including 1.51.1
- Fixed in Forminator Forms version 1.52
- WordPress sites exposing Forminator Templates or Reports pages to low-privilege roles
Discovery Timeline
- 2026-05-07 - CVE-2026-6222 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-6222
Vulnerability Analysis
The vulnerability stems from broken access control in admin/abstracts/class-admin-module-edit-page.php. The processRequest() method handles module-management actions including export, delete, clone, delete-entries, publish/draft, and bulk variants. The method validates only the forminator_form_request nonce before executing these actions. It never checks whether the requesting user holds the manage_forminator_modules capability.
The nonce is unconditionally embedded in the global forminatorData JavaScript object. WordPress localizes this object on every Forminator admin page, including Templates and Reports pages accessible to users explicitly restricted from module management. Any authenticated user reaching those pages obtains a valid nonce.
Root Cause
processRequest() is invoked during the admin_menu action hook. This hook fires before WordPress enforces page-level capability checks. The handler short-circuits the normal capability gate, so a user whose Forminator role is limited to Templates or Reports can still target any published module. The absent capability check on sensitive POST actions is the core defect.
Attack Vector
An authenticated attacker with subscriber-level access or any custom low-privilege Forminator role browses an allowed admin page to obtain the localized forminator_form_request nonce. The attacker then crafts a POST request to a Forminator admin endpoint specifying an action such as export, delete, clone, or delete-entries and the target module ID. The request succeeds because processRequest() validates the nonce only. Exported payloads include notification routing, integration credentials, and conditional logic for the targeted form, poll, or quiz.
See the Wordfence Vulnerability Report and the Forminator 1.51.1 source reference for technical details.
Detection Methods for CVE-2026-6222
Indicators of Compromise
- POST requests to WordPress admin endpoints carrying forminator_form_request nonces from accounts holding only subscriber or restricted Forminator roles.
- Unexpected Forminator module export, delete, clone, or delete-entries actions in WordPress audit logs.
- Outbound traffic from form integrations to unfamiliar destinations after configuration exports.
Detection Strategies
- Audit WordPress access logs for low-privilege user IDs invoking admin.php requests with Forminator action parameters such as export, delete, clone, or bulk.
- Compare current Forminator module counts and publish states against known-good baselines to surface unauthorized deletions or status changes.
- Inspect plugin version reporting across managed WordPress hosts to identify instances still running 1.51.1 or earlier.
Monitoring Recommendations
- Enable WordPress activity logging on user role changes, plugin admin actions, and form module modifications.
- Alert when subscriber-level accounts trigger Forminator admin AJAX or POST endpoints.
- Review notification routing and third-party integration credentials embedded in Forminator forms for unauthorized changes.
How to Mitigate CVE-2026-6222
Immediate Actions Required
- Update the Forminator Forms plugin to version 1.52 or later on all WordPress installations.
- Rotate any third-party integration credentials and webhook secrets stored in Forminator forms, polls, or quizzes.
- Review existing user accounts and remove unused subscriber-level or custom Forminator roles.
Patch Information
Forminator 1.52 adds the missing capability check to processRequest(). The patched code is visible at the Forminator 1.52 source reference. Site administrators should apply the update through the WordPress plugin manager or via WP-CLI.
Workarounds
- Restrict access to wp-admin for low-privilege roles using a web application firewall rule until the patch is applied.
- Temporarily revoke access to Forminator Templates and Reports pages for non-administrative users.
- Disable the Forminator plugin if patching is not immediately feasible and forms can tolerate downtime.
# Update Forminator via WP-CLI
wp plugin update forminator --version=1.52
wp plugin status forminator
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
