Forminator Security Flaws: Check Your Version in a Minute

If your WordPress site uses the Forminator Forms plugin, make sure it is on version 1.57.2.1 or later. Anything older carries two published security flaws, one of which needs no login to use. The fix has been out since 17 September 2026, so for most sites this is a one-click update.

Forminator is one of the most common free form builders for WordPress, with more than 600,000 active installations listed on WordPress.org. On a lot of small business sites it runs the contact form and nobody has looked at it since the site went live, which is why it is worth a minute today.

What’s affected

Both flaws are in Forminator Forms, the plugin by WPMU DEV. They were published in mid-September 2026.

CVE-2026-92229, rated 9.1 (critical). Affects every version up to and including 1.57.2. A visitor without an account can make your site run WordPress shortcodes it was never meant to run. A shortcode is the small bracketed tag plugins use to drop features into a page, so how much harm this allows depends on which other plugins you have installed and what their shortcodes can do. It was reported through Wordfence and is listed in the National Vulnerability Database.

CVE-2026-87067, rated 8.5 (high). Affects versions before 1.57.2.1. Someone who holds Forminator’s form-management permission can write a file to your server and run code with it. By default only administrators hold that permission, but Forminator lets you hand it to other user roles, and on sites that have done so, a much less trusted account could use it. The details are in the WPScan advisory.

At the time of writing neither flaw appears on the US government’s list of vulnerabilities known to be exploited. That can change. WPScan has said it will publish its proof-of-concept for the second flaw on 18 October 2026, and once working examples are public, automated scanning for unpatched sites usually follows. Update before then.

How to check in a minute

1. Log in to your WordPress admin.
2. Go to Plugins, then Installed Plugins.
3. Find Forminator Forms in the list. The version number sits under the plugin description.

If it reads 1.57.2.1 or higher, you are covered for both flaws. The current release at the time of writing is 1.57.3.

If you can’t log in to the admin yourself, because an agency or freelancer looks after the site, send them one line: “Which version of Forminator is our site running?” They should be able to answer the same day. If you don’t know whether you use Forminator at all, the same Installed Plugins screen will tell you.

What to do if you’re on an older version

Update the plugin. On the Installed Plugins screen there will be an “update now” link under Forminator. If your host doesn’t take automatic backups, take one first, because updating any plugin carries a small chance of a clash with something else on the site.

After updating:

• Submit one of your own forms and check the email or entry comes through, so you know the update didn’t break anything.
• Click “Enable auto-updates” next to Forminator on the plugins screen, so the next fix installs without anyone needing to remember.
• If you ever gave other user roles access to Forminator (under Forminator’s Settings, then Permissions), check that list still makes sense. That setting is what widens the second flaw beyond administrators.
• If the site has been on an old version for a long time, glance at the Users list for any administrator account you don’t recognise. That is general good practice after any serious flaw, not something either advisory reports.

If you installed Forminator once and no longer use it, deactivate and delete it rather than updating it. Deactivating alone leaves the plugin’s files on the server.

Why one plugin turns into a website problem

An out-of-date plugin is one of the commonest ways a small business site gets compromised. Automated tools sweep the web for sites running a known vulnerability and try the published method on every one they find, so being small doesn’t keep you off the list. A site with 25 plugins has 25 things that each need updating on their own schedule, and in most small businesses nobody owns that job.

That is the part we look after for clients. A WordPress site we build or take on gets its updates applied and tested on a schedule, and on a support retainer we watch for alerts like this one and apply the fix ourselves.

Not sure what else is out of date?

Forminator is one plugin. If this is the first time you’ve checked a version number on your site, there will usually be others behind too. Run our free website scan for a quick read on security and speed, or tell us about your site using the form below and we’ll look at what it’s running and come back with what needs updating first.