CVE-2026-87074 Overview
CVE-2026-87074 affects the Forminator Forms WordPress plugin in versions before 1.57.2.1. The plugin's saved-draft notification feature fails to bind the notification to the visitor who created the draft. Both the recipient address and the link embedded in the notification message are taken directly from the incoming request. As a result, unauthenticated visitors can trigger the site to send messages from its own mail configuration to any address, carrying attacker-supplied links inside the site's own email template. The authorization token that permits the send is returned to the anonymous caller by the plugin itself and can be replayed indefinitely. The issue is tracked as a missing authorization weakness [CWE-862].
Critical Impact
Unauthenticated attackers can abuse a vulnerable site's mail configuration to distribute attacker-chosen links from a trusted sender domain, enabling phishing and reputational harm.
Affected Products
- Forminator Forms WordPress plugin versions prior to 1.57.2.1
- WordPress sites running the affected plugin with saved-draft notifications enabled
- Mail infrastructure associated with sites hosting the vulnerable plugin
Discovery Timeline
- 2026-09-23 - CVE-2026-87074 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-87074
Vulnerability Analysis
The Forminator Forms plugin exposes a saved-draft notification endpoint that emails a resume link to a specified recipient. The endpoint does not associate the draft with the session or identity of the visitor who created it. Instead, the recipient address and the link written into the message body are both accepted from user-controlled request parameters. The plugin also returns the send-authorization token to the anonymous caller and does not invalidate it after use. Unauthenticated attackers can therefore send unlimited messages through the site's own mail configuration, each carrying a link of the attacker's choosing wrapped in the site's legitimate email template.
Root Cause
The root cause is missing authorization [CWE-862] on the saved-draft notification handler. The handler trusts request-supplied recipient and link parameters without verifying the requester's ownership of the draft. The token that gates the send is exposed to the same anonymous caller and lacks single-use or expiry semantics, allowing replay.
Attack Vector
Exploitation occurs over the network without authentication or user interaction. An attacker crafts requests to the draft notification endpoint, supplies an arbitrary recipient email and link, and replays the token returned by the plugin. The victim receives a message that originates from the site's own mail configuration, uses the site's branded template, and contains the attacker's link. See the WPScan Vulnerability Report for technical details.
// Verified exploit code is not available. Refer to the WPScan advisory for
// request-level details of the vulnerable saved-draft notification endpoint.
Detection Methods for CVE-2026-87074
Indicators of Compromise
- Outbound mail from the WordPress site addressed to recipients that do not correspond to registered users or legitimate form submitters.
- Saved-draft notification emails containing links to domains unrelated to the site or its expected form workflows.
- Repeated requests to Forminator saved-draft notification endpoints from a single IP with varying recipient parameters.
Detection Strategies
- Inspect web server access logs for high-volume POST requests to Forminator draft-save and notification endpoints from unauthenticated sessions.
- Correlate mail transfer agent logs with WordPress request logs to identify draft notification messages triggered without a corresponding authenticated session.
- Alert on reused authorization tokens appearing across multiple send requests from the same or differing source addresses.
Monitoring Recommendations
- Monitor outbound email volume and recipient diversity for WordPress hosts running Forminator Forms.
- Track the plugin version across WordPress installations and flag any host below 1.57.2.1.
- Enable request-body logging for Forminator endpoints so recipient and link parameters can be audited after the fact.
How to Mitigate CVE-2026-87074
Immediate Actions Required
- Upgrade the Forminator Forms plugin to version 1.57.2.1 or later on all WordPress installations.
- Review recent outbound mail logs for suspicious saved-draft notifications and notify affected recipients if abuse is confirmed.
- Rotate any authorization tokens or API secrets tied to the site's mail configuration if abuse indicators are found.
Patch Information
The vendor has addressed the issue in Forminator Forms 1.57.2.1. Site operators should apply the update through the WordPress plugin manager or WP-CLI. Consult the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Disable the saved-draft notification feature in Forminator forms until the patched version is deployed.
- Restrict access to Forminator endpoints at the web application firewall by requiring authenticated sessions for draft notification requests.
- Apply outbound mail rate limits per source IP and per session to reduce the impact of replay attempts.
# Update Forminator Forms to the patched version using WP-CLI
wp plugin update forminator --version=1.57.2.1
wp plugin list --name=forminator --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.