CVE-2026-87067: Forminator Forms WordPress Plugin RCE

CVE-2026-87067 Overview

CVE-2026-87067 is an insecure deserialization vulnerability in the Forminator Forms WordPress plugin before version 1.57.2.1. The plugin fails to restrict which classes may be instantiated when deserializing a value taken from an XML-RPC request. Users holding the forms-management permission can write arbitrary files and execute code on the underlying server. Administrators hold this permission by default, and site owners can grant it to lower-privileged roles through the plugin's own settings. The flaw maps to CWE-94: Improper Control of Generation of Code.

Critical Impact

Authenticated users with forms-management permission can achieve arbitrary code execution on the WordPress host, leading to full site compromise.

Affected Products

• Forminator Forms WordPress plugin versions prior to 1.57.2.1
• WordPress sites exposing the XML-RPC endpoint with the plugin installed
• Sites that delegate Forminator forms-management to non-administrator roles

Discovery Timeline

• 2026-09-20 - CVE-2026-87067 published to NVD
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-87067

Vulnerability Analysis

The Forminator Forms plugin exposes deserialization logic reachable through the WordPress XML-RPC interface. When the plugin processes an XML-RPC request, it deserializes a value without constraining the set of allowable classes. An attacker who holds the plugin's forms-management capability can submit a crafted payload that instantiates arbitrary classes present in the WordPress runtime. Chained PHP object gadgets can then be used to write attacker-controlled content to disk and load that content as executable code.

The issue is reachable well below administrator on sites that have delegated forms-management to editor, author, or custom roles. Because XML-RPC is enabled by default in most WordPress installations, the attack surface extends beyond the standard wp-admin interface. Additional context is available in the WPScan Vulnerability Report.

Root Cause

The root cause is unrestricted PHP object deserialization inside an XML-RPC handler. The plugin invokes unserialize() on request-controlled input without an allowed_classes allow-list, permitting instantiation of any class loaded in the WordPress process. Combined with __destruct, __wakeup, or __toString gadgets in WordPress core or bundled libraries, this yields arbitrary file writes and code execution.

Attack Vector

Exploitation requires network access to the WordPress xmlrpc.php endpoint and valid credentials for an account holding Forminator's forms-management permission. The attacker authenticates over XML-RPC, submits a request containing a serialized PHP object graph, and triggers gadget execution during deserialization. A successful chain writes a PHP file into the webroot or plugin directory, which the attacker then requests to execute arbitrary code under the web server user.

No verified public proof-of-concept code is available. See the WPScan advisory for further technical detail.

Detection Methods for CVE-2026-87067

Indicators of Compromise

• Unexpected PHP files created in wp-content/uploads/, wp-content/plugins/forminator/, or the WordPress webroot with recent modification timestamps
• POST requests to /xmlrpc.php containing serialized PHP payload markers such as O: or a: inside XML <value> elements
• Web server processes spawning shell interpreters (sh, bash) or writing files outside expected plugin paths
• New or modified administrator accounts created shortly after suspicious XML-RPC traffic

Detection Strategies

• Inspect access logs for authenticated XML-RPC requests originating from accounts that do not normally use the API
• Alert on PHP unserialize() calls in application traces where the input source is an XML-RPC payload
• Monitor for outbound connections initiated by the PHP-FPM or Apache worker process immediately after XML-RPC activity
• Correlate Forminator plugin version telemetry against the fixed version 1.57.2.1 across managed WordPress fleets

Monitoring Recommendations

• Enable WordPress audit logging for role and capability changes involving Forminator forms-management
• Forward web server, PHP error, and WordPress audit logs to a centralized platform for retention and correlation
• Baseline normal XML-RPC traffic volume and alert on deviations, particularly requests exceeding typical payload size
• Track file integrity for the wp-content directory tree and flag new executable PHP files

How to Mitigate CVE-2026-87067

Immediate Actions Required

• Upgrade the Forminator Forms plugin to version 1.57.2.1 or later on every WordPress site in your estate
• Audit which non-administrator roles have been granted the plugin's forms-management permission and revoke it where not required
• Disable the XML-RPC endpoint if no integrations depend on it, or restrict xmlrpc.php to trusted IP ranges
• Review file integrity in the WordPress webroot for unauthorized PHP files created before the patch was applied

Patch Information

The vendor addressed the vulnerability in Forminator Forms 1.57.2.1 by restricting the classes permitted during deserialization of XML-RPC values. Site operators should update through the WordPress plugin manager or by deploying the patched plugin package. See the WPScan Vulnerability Report for advisory metadata.

Workarounds

• Block or filter POST /xmlrpc.php at the web application firewall until the plugin is patched
• Temporarily deactivate the Forminator Forms plugin on sites that cannot be upgraded immediately
• Restrict the forms-management capability to administrators only via a role-management plugin
• Enforce strong authentication and rate limiting on XML-RPC to reduce credential-based exposure

# Apache configuration example: restrict XML-RPC access
<Files "xmlrpc.php">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Files>

# Nginx equivalent
location = /xmlrpc.php {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}