CVE-2026-19221: CWE-94 Improper Control of Generation of Code ('Code Injection') in Forminator Forms

The Forminator Forms WordPress plugin before version 1.57.0.5 contains a code injection vulnerability (CWE-94) that arises from insufficient restriction of a network-wide setting. Specifically, an administrator of any single site within a multisite WordPress network can exploit this flaw to execute arbitrary code across the entire network. This elevates privileges beyond intended limits and can lead to full compromise of the multisite environment. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrator privileges on a single site within a multisite WordPress network to execute arbitrary code across the entire network. This can lead to full compromise of all sites in the network, including data theft, site defacement, or further malware deployment. The vulnerability affects confidentiality, integrity, and availability of the multisite environment.

A fix is available in Forminator Forms version 1.57.0.5 and later. Users should upgrade to version 1.57.0.5 or newer to remediate this vulnerability. No other mitigation guidance is provided. Patch status is confirmed by the version information indicating the vulnerability exists before 1.57.0.5.