CVE-2026-19220 — Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated vis…
Published: 2026-08-26 · CVSS: 3.7 · CVSS 3.1
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7