CVE-2026-19220: CWE-269 Improper Privilege Management in Forminator Forms

CVE-2026-19220 is an improper privilege management vulnerability (CWE-269) in the Forminator Forms WordPress plugin prior to version 1.57.1. The plugin fails to verify that site registration is enabled on a multisite network before allowing site signup creation. This allows unauthenticated users to create new sites and obtain administrator privileges on those sites within the multisite environment. The vulnerability has a CVSS 3.1 base score of 3.7, indicating low severity. There is no vendor advisory or patch information available at this time.

An attacker can create a new site on a WordPress multisite network without authentication and gain administrator privileges on that site. This could allow limited administrative control within the multisite environment but does not directly impact the entire network or other sites. The overall impact is considered low severity based on the CVSS score and described privileges gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling site registration on multisite networks if not required, as a temporary mitigation to prevent unauthorized site creation.