CVE-2026-87067

COMPONENT VERSION RANGE

NewScan fingerprints forminator from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-09-20 (/daily-cve). Unrestricted class instantiation during deserialisation is the precondition for a property-oriented gadget chain, so the ceiling is whatever gadget the site's own plugin and theme set supplies - on a WordPress install that set is large and not something the operator curated, which is why this is high rather than medium despite needing an account. The reachable surface is XML-RPC, which is ON by default on a stock WordPress and is the part operators most often forget is listening. SLUG VERIFIED: api.wordpress.org/plugins/info/1.0/forminator.json answers 'Forminator Forms - Contact Form, Payment Form & Custom Form Builder' at 1.57.3, so 1.57.2.1 is a published release and already superseded. Version source is the standard WordPress component route scan_wordpress already walks and needs no code: assets are served as /wp-content/plugins/forminator/<...>?ver=<plugin version>, keyed by wordpress_tools.find_plugins on the directory slug `forminator` (this row's key) and refined where present by readme.txt `Stable tag:`. Version-match only and deliberately: proving object injection means instantiating attacker-chosen classes inside the customer's PHP process, which is the damage the finding warns about.