The Forminator Forms WordPress plugin prior to version 1.57.0.7 contains a CWE-269 Improper Privilege Management vulnerability. Specifically, the plugin does not consistently enforce role restrictions on registration forms, which enables users authorized to build forms to configure a registration form that assigns the administrator role to any visitor registering via that form. This flaw allows privilege escalation by granting administrative rights to unauthorized users.

An attacker who has permission to create or modify forms in the vulnerable versions of the Forminator Forms plugin can exploit this vulnerability to assign themselves or others the administrator role upon registration. This results in a significant privilege escalation, potentially compromising the entire WordPress site by granting full administrative control to unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict form-building permissions to trusted users only and monitor for suspicious form configurations that could assign elevated roles.