CVE-2026-87070: Forminator Forms WordPress Auth Bypass

CVE-2026-87070 Overview

CVE-2026-87070 affects the Forminator Forms WordPress plugin in versions prior to 1.57.2.1. The plugin trusts client-supplied forwarding headers such as X-Forwarded-For without verifying that the request originated from a trusted proxy. Forminator uses the extracted address for two security-sensitive decisions: enforcing per-visitor poll voting limits and recording the submitter address on form entries. Unauthenticated attackers can spoof arbitrary client addresses to bypass voting restrictions and to attribute submissions to addresses they do not control. The flaw is categorized under [CWE-348] Use of Less Trusted Source.

Critical Impact

Unauthenticated remote attackers can cast unlimited poll votes and forge the source address recorded against every form submission.

Affected Products

• Forminator Forms WordPress plugin versions prior to 1.57.2.1
• WordPress sites running polls through the Forminator plugin
• WordPress sites collecting form entries with Forminator for audit or compliance purposes

Discovery Timeline

• 2026-09-23 - CVE-2026-87070 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-87070

Vulnerability Analysis

Forminator Forms determines the visitor address by preferring forwarding headers over the transport-layer connecting address. Values such as X-Forwarded-For, X-Real-IP, or Client-IP are commonly injected by upstream reverse proxies and load balancers. The plugin accepts those headers unconditionally, without checking that the direct peer is an allow-listed proxy. Any unauthenticated visitor can supply arbitrary values in those headers and the plugin will treat them as authoritative.

Two downstream controls depend on that value. The poll module uses it as a uniqueness key when enforcing per-visitor voting limits. The form submission handler stores it against every entry as the submitter's address. Attackers who rotate the spoofed value defeat both controls simultaneously, distorting poll results and poisoning submission audit trails referenced during abuse investigations.

Root Cause

The root cause is Use of Less Trusted Source [CWE-348]. The plugin trusts data supplied by the HTTP client over data derived from the TCP connection. Correct behavior requires reading REMOTE_ADDR by default and only honoring forwarding headers when the immediate peer matches a configured trusted proxy list.

Attack Vector

Exploitation requires only the ability to send HTTP requests to a vulnerable WordPress site. An unauthenticated attacker crafts requests to the Forminator poll or form endpoint and includes a spoofed forwarding header on each request. Rotating the header value across requests bypasses the voting limit and populates entry records with attacker-chosen addresses. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-87070

Indicators of Compromise

• Poll vote totals that grow faster than legitimate site traffic could explain, or vote counts exceeding unique visitor counts in analytics.
• Form entries in the Forminator dashboard showing implausible source addresses, including reserved ranges, sequential ranges, or addresses geographically inconsistent with expected users.
• Repeated requests to Forminator submission endpoints from a single upstream peer while carrying varying X-Forwarded-For values.

Detection Strategies

• Compare the transport-layer source address in web server access logs against the forwarding headers recorded by the application to identify mismatches that indicate spoofing attempts.
• Alert on high-cardinality forwarding-header values originating from a small number of physical source addresses.
• Review Forminator entry exports for duplicate submission patterns tied to changing source addresses.

Monitoring Recommendations

• Enable verbose logging on the reverse proxy or web server to capture both the direct peer address and all forwarding headers on every request to /wp-admin/admin-ajax.php and Forminator REST routes.
• Baseline expected poll voting velocity and alert on deviations that could indicate automated ballot stuffing.
• Monitor WordPress plugin inventory for Forminator installations still on versions prior to 1.57.2.1.

How to Mitigate CVE-2026-87070

Immediate Actions Required

• Upgrade the Forminator Forms plugin to version 1.57.2.1 or later on every WordPress site in the estate.
• Audit poll results and form entries generated before patching to identify submissions that must be discarded or re-collected.
• Confirm that the front-facing reverse proxy overwrites, rather than appends to, forwarding headers received from external clients.

Patch Information

The vendor fixed the issue in Forminator Forms 1.57.2.1. Update through the WordPress plugin manager or by deploying the patched release. Full remediation details are documented in the WPScan Vulnerability Report.

Workarounds

• Configure the upstream proxy or web application firewall to strip inbound X-Forwarded-For, X-Real-IP, and Client-IP headers before requests reach WordPress.
• Where possible, disable public polls until the plugin can be updated to prevent unlimited voting abuse.
• Apply rate limiting at the edge on Forminator submission endpoints to constrain automated abuse.

# Nginx example: strip client-supplied forwarding headers and set a trusted value
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Client-IP "";