{"id":"CVE-2026-87067","published":"2026-09-20T07:16:50.430","lastModified":"2026-09-21T13:34:57.127","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms  WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows users with forms-management permissions to execute arbitrary code by deserializing a value from an XML-RPC request, posing a high risk due to the broad permissions associated with this role.","exploitability":"Exploitation is relatively straightforward for attackers who can send a crafted XML-RPC request, requiring the target to have the forms-management permission, typically held by administrators.","blast_radius":"If exploited, the issue could lead to full compromise of the WordPress site, including data theft, unauthorized code execution, and potential propagation to other sites managed by the same user.","remediation":"Upgrade to Forminator Forms 1.57.2.1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","xml-rpc","arbitrary-code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:49:23.302Z"}}