CVE-2026-87071 Overview
CVE-2026-87071 affects the Forminator Forms WordPress plugin before version 1.57.2.1. The plugin fails to restrict which metadata keys a form submission may supply and does not exclude keys that WordPress reserves for internal use. Unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates. The flaw is classified under [CWE-20] Improper Input Validation and enables integrity impact against WordPress posts generated from form submissions.
Critical Impact
Unauthenticated attackers can inject arbitrary WordPress post metadata, including reserved keys, by submitting crafted public forms that generate posts.
Affected Products
- Forminator Forms WordPress plugin versions prior to 1.57.2.1
- WordPress sites exposing public Forminator forms that create posts from submissions
- Any WordPress deployment relying on Forminator post-generation workflows for content integrity
Discovery Timeline
- 2026-09-23 - CVE-2026-87071 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-87071
Vulnerability Analysis
Forminator Forms allows site administrators to build public forms that create WordPress posts from user submissions. The submission handler accepts metadata field names from client-supplied input without applying an allowlist. It also fails to exclude keys that WordPress reserves for its own bookkeeping, such as internal post state and template markers.
An unauthenticated attacker submitting a public form can attach arbitrary postmeta entries to the resulting post. Because reserved keys are not filtered, the attacker can influence post attributes that WordPress and other plugins read from post metadata. The confidentiality impact is none, but integrity is affected because attacker-controlled data enters trusted metadata storage.
Exploitation requires only network access to a form that generates posts. No authentication, privileges, or user interaction are needed on the target site. The vulnerability is scored with an EPSS probability of 0.186%.
Root Cause
The root cause is missing input validation on the metadata key namespace accepted by the form submission handler. The plugin trusts client-supplied field identifiers and passes them to WordPress metadata APIs without an allowlist or reserved-key filter. This is a textbook [CWE-20] Improper Input Validation issue applied to a metadata write path.
Attack Vector
The attacker locates a public Forminator form on the target site that creates a post from submissions. The attacker crafts an HTTP POST request containing additional metadata field names, including WordPress reserved keys, alongside legitimate form data. When the plugin processes the submission, the attacker-supplied keys are written to the post's metadata store. See the WPScan Vulnerability Report for technical details.
No verified public proof-of-concept code is available. The vulnerability mechanism relies on standard HTTP form submission with additional parameter names mapped to metadata keys the plugin should have rejected.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-87071
Indicators of Compromise
- WordPress posts created from Forminator submissions containing postmeta entries with unexpected keys, particularly keys beginning with an underscore that indicate reserved WordPress metadata.
- Form submission log entries showing unusually large parameter counts or field names that do not match the form's configured schema.
- Anomalous post metadata rows in the wp_postmeta table associated with posts whose author is the default submission user configured in Forminator.
Detection Strategies
- Audit the wp_postmeta table for reserved or unexpected meta_key values on posts created after a Forminator submission and compare against the form's declared field set.
- Inspect web server access logs for POST requests to Forminator submission endpoints containing parameter names not defined in the target form.
- Deploy a web application firewall rule that logs form submissions containing metadata parameter names outside a known allowlist.
Monitoring Recommendations
- Enable WordPress audit logging for post creation and post metadata updates originating from unauthenticated sessions.
- Alert on new postmeta rows written with keys prefixed by an underscore for posts created through Forminator workflows.
- Track the installed Forminator plugin version across managed WordPress sites and flag any instance older than 1.57.2.1.
How to Mitigate CVE-2026-87071
Immediate Actions Required
- Upgrade the Forminator Forms plugin to version 1.57.2.1 or later on every WordPress site in the environment.
- Review all public Forminator forms configured to create posts and disable submission-to-post workflows that are not strictly required.
- Audit posts created by Forminator during the exposure window and remove attacker-injected metadata entries from wp_postmeta.
Patch Information
The vendor addressed the vulnerability in Forminator Forms version 1.57.2.1. The fix restricts metadata keys accepted from form submissions and excludes WordPress reserved keys. Refer to the WPScan Vulnerability Report for advisory details and upgrade guidance.
Workarounds
- Reconfigure affected forms to disable the post-creation feature until the plugin can be updated to 1.57.2.1.
- Place a web application firewall rule in front of the Forminator submission endpoint that strips or blocks parameters not present in the form's configured field list.
- Restrict access to forms that generate posts using authentication or IP allowlisting where the business use case permits.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
