CVE-2026-87067Patch

LOWCVSS 8.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/9f5da02e-55af-463f-8b1a-9fe792d589c4/

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Peaked 2d ago at 2 mentions (2026-09-20); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Patch

375.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-20	2	Disclosure1Patch1
2026-09-21	1	Patch1
2026-10-31	1	Patch1

Full discourse4 posts

Hugo | DevOps | Cybersecurity@HugoValters5d
Patch
CVE-2026-87067 Forminator WordPress plugin before 1.57.2.1: unsafe deserialization via XML-RPC enables arbitrary file write and RCE. CVSS 8.5, patch status unpatched. Update to 1.57.2.1 now. #CVE #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-87067 #Forminator #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The tweet discloses a critical RCE vulnerability (CVE-2026-87067) in the Forminator WordPress plugin and primarily urges users to update to version 1.57.2.1 to remediate the issue.
0000158
1.1K followersView on X
NewNormal Security@NewScanTeam46d
Disclosure
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 20 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Missing authorization in a WordPress gallery plugin — any logged-in user reads image records they were never granted, including client proofing sets (NextGEN Gallery CVE-2026-81652, CVE-2026-81654) 📦 PHP object injection over XML-RPC — attacker-chosen classes instantiated inside the site (Forminator CVE-2026-87067) 🔎 Reverse-proxy admin panel now fingerprinted with its release — the box fronting a self-hosted estate appears in the inventory, so advisories against it can be matched (nginx-proxy-manager CVE-2026-93964) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #BrokenAccessControl #CSO #REDTEAM
Post summary
The tweet announces several newly detected CVEs affecting WordPress plugins and related software, describing their vulnerability types but without mentioning exploits, patches, or active attacks.
0100055
7 followersView on X
ADK Cyber@ADKCyber46d
Patch
CVE-2026-87067 (CVSS 8.5): Forminator Forms WordPress plugin before 1.57.2.1 has a deserialization issue via XML-RPC. Update if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-87067 adkcyber… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/kLuKd5JIDK
Post summary
The tweet discloses CVE-2026-87067, a deserialization issue (CVSS 8.5) in Forminator Forms WordPress plugin before 1.57.2.1 via XML-RPC, and explicitly urges users to update if in use.
0000053
96 followersView on X
Severity Daily@severitydaily46d
Patch
Forminator’s 8.5 remote code execution on 600,000 WordPress sites shipped as one changelog line: “Fix: Security improvements.” The CVE landed three days later. No exploitation reported. https://severitydaily.com/forminator-cve-2026-87067-xml-rpc-object-injection-8-5-changelog-security-improvements/
Post summary
The post discloses a remote code execution flaw in Forminator 8.5 impacting many WordPress sites, noting a vague 'Security improvements' fix in the changelog and stating that no exploitation has been observed.
0000034
24 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-87067

Hugo | DevOps | Cybersecurity[verified]@HugoValtersPatch

The tweet discloses a critical RCE vulnerability (CVE-2026-87067) in the Forminator WordPress plugin and primarily urges users to update to version 1.57.2.1 to remediate the issue.

NewNormal Security[verified]@NewScanTeamDisclosure

The tweet announces several newly detected CVEs affecting WordPress plugins and related software, describing their vulnerability types but without mentioning exploits, patches, or active attacks.

ADK Cyber[verified]@ADKCyberPatch

The tweet discloses CVE-2026-87067, a deserialization issue (CVSS 8.5) in Forminator Forms WordPress plugin before 1.57.2.1 via XML-RPC, and explicitly urges users to update if in use.

Severity Daily[verified]@severitydailyPatch

The post discloses a remote code execution flaw in Forminator 8.5 impacting many WordPress sites, noting a vague 'Security improvements' fix in the changelog and stating that no exploitation has been observed.