{"id":"CVE-2026-87069","aliases":["EUVD-2026-85047","GHSA-fggp-vvqp-gp2f"],"status":"published","title":"Forminator Forms \u003c 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00209,"percentile":0.11222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-23T06:00:19Z","modified":"2026-09-23T18:13:31Z","products":[{"vendor":"unknown","product":"forminator forms"}],"references":[{"url":"https://wpscan.com/vulnerability/cf14469d-eb14-4ab0-acdd-318a6c9d5d92/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87069"},{"url":"https://wpscan.com/vulnerability/cf14469d-eb14-4ab0-acdd-318a6c9d5d92"},{"url":"https://github.com/advisories/GHSA-fggp-vvqp-gp2f"}],"sources":{"cve":[{"id":"CVE-2026-87069","title":"Forminator Forms \u003c 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.","status":"published","published":"2026-09-23T06:00:19.856Z","modified":"2026-09-23T10:54:39.174Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-85047","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.","status":"published","published":"2026-09-23T06:00:19Z","modified":"2026-09-23T10:54:39Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:28:01.283316Z"}],"ghsa":[{"id":"GHSA-fggp-vvqp-gp2f","title":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or...","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.","status":"published","published":"2026-09-23T06:31:04Z","modified":"2026-09-23T12:31:11Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:12:19.869437Z"}],"nvd":[{"id":"CVE-2026-87069","description":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.","status":"published","published":"2026-09-23T06:17:04.45Z","modified":"2026-09-23T18:13:31.21Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:50.703874Z"}]}}