CVE-2026-87070: CWE-348 Use of Less Trusted Source in Forminator Forms
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
AI Analysis
Technical Summary
CVE-2026-87070 is a vulnerability in the Forminator Forms WordPress plugin versions prior to 1.57.2.1. The plugin does not verify that requests come from trusted proxies before preferring client-supplied forwarding headers over the connecting IP address. This flaw is exploited in the context of enforcing per-visitor voting limits and recording submission addresses. Because of this, unauthenticated visitors can submit unlimited votes on polls and can specify arbitrary addresses to be recorded with their entries. The vulnerability is classified as CWE-348 (Use of Less Trusted Source).
Potential Impact
Attackers can bypass voting limits on polls, allowing unlimited votes from unauthenticated users. Additionally, they can spoof the IP address recorded with each submission, potentially undermining the integrity of poll data and any IP-based tracking or restrictions.
Mitigation Recommendations
A fix is available in Forminator Forms version 1.57.2.1. Users should upgrade to this version or later to remediate the vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 1.57.2.1 are vulnerable.
CVE-2026-87070: CWE-348 Use of Less Trusted Source in Forminator Forms
Description
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
CVSS v3.1
Score 5.3medium
Affected software
Forminator Forms
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87070 is a vulnerability in the Forminator Forms WordPress plugin versions prior to 1.57.2.1. The plugin does not verify that requests come from trusted proxies before preferring client-supplied forwarding headers over the connecting IP address. This flaw is exploited in the context of enforcing per-visitor voting limits and recording submission addresses. Because of this, unauthenticated visitors can submit unlimited votes on polls and can specify arbitrary addresses to be recorded with their entries. The vulnerability is classified as CWE-348 (Use of Less Trusted Source).
Potential Impact
Attackers can bypass voting limits on polls, allowing unlimited votes from unauthenticated users. Additionally, they can spoof the IP address recorded with each submission, potentially undermining the integrity of poll data and any IP-based tracking or restrictions.
Mitigation Recommendations
A fix is available in Forminator Forms version 1.57.2.1. Users should upgrade to this version or later to remediate the vulnerability. Patch status is confirmed by the affectedVersions field indicating versions before 1.57.2.1 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T19:04:16.618Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab3aaf0f7a7c54106a5313c
Added to database: 09/23/2026, 10:33:20 UTC
Last enriched: 09/23/2026, 10:48:12 UTC
Last updated: 09/23/2026, 13:58:27 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.