CVE-2026-87074

Katalog CVE

CVSS 3.7 · Low EPSS 0,15%

Kerentanan Missing Authorization. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP.

Deskripsi (NVD)

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

23 September 2026

Status NVD

Deferred

CVSS 3.1

3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/