Forminator Forms Plugin Flaw Enables Remote Code Execution via XML-RPC

Executive Summary

A high-severity insecure deserialization vulnerability (CVE-2026-87067, CVSS 8.5) has been disclosed in Forminator Forms, a popular WPMU DEV form-builder plugin for WordPress. Versions before 1.57.2.1 do not restrict which PHP classes may be instantiated when deserializing a value taken from an XML-RPC request, allowing any user who holds the plugin's forms-management permission to write an arbitrary file to the server and execute code.

That permission belongs to administrators by default — but is reachable by lower roles on any site that has granted it through the plugin's own settings, meaning the effective attack surface extends below the admin tier wherever that feature is used.

Vulnerability Overview

Root Cause

Forminator processes certain XML-RPC requests by deserializing a value directly from the request without validating or whitelisting which PHP classes are permitted to be instantiated. Without strict class checking, an attacker who can reach the forms-management functionality can craft a serialized payload that instantiates classes with useful side effects in their constructors, destructors, or wakeup methods — in this case, enough to write a file of the attacker's choosing to a web-accessible path and subsequently execute it.

A companion issue, CVE-2026-87068, was disclosed alongside this one: it allows a user permitted to import quizzes to smuggle a registration form inside the import that grants any submitter an arbitrary role, including administrator — bypassing the role restriction enforced by the plugin's normal form editor.

Affected Versions

Attack Vector

1. Attacker holds (or is granted) Forminator's forms-management permission
2. Attacker sends a crafted XML-RPC request containing a malicious serialized payload
3. Plugin deserializes the value without class whitelisting
4. Instantiated object's side effects write an attacker-controlled file to disk
5. Attacker requests the written file over HTTP to achieve code execution

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 1.57.2.1

wp plugin update forminator
wp plugin get forminator --field=version

Step 2: Restrict XML-RPC Access

If XML-RPC is not required for legitimate integrations, disable it entirely:

# Block XML-RPC at the web server level (Nginx example)
location = /xmlrpc.php {
    deny all;
}

Step 3: Audit Forms-Management Permission Grants

wp user list --fields=user_login,roles

Confirm forms-management permission is limited to trusted administrators only, and review the plugin's own role-permission settings for any non-default grants.

If Immediate Patching Is Not Possible

1. Disable XML-RPC at the web server or WAF level
2. Revoke forms-management permission from any role below administrator
3. Scan for unexpected PHP files written after the disclosure date

find /path/to/wordpress/wp-content/uploads/ -name "*.php" -newer /path/to/wordpress/wp-includes/version.php -type f

References

• OffSeq Threat Radar — CVE-2026-87067
• NVD — CVE-2026-87067

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• CVE-2026-0953: Critical Auth Bypass in Tutor LMS Pro