External risk intelligence

Forminator Plugin PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-66583

The vulnerability exists in a WordPress plugin used to create forms. Such plugins are typically deployed on public-facing websites to collect user input, making the vulnerable endpoint reachable via the internet as a standard component of the web application's functionality.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a widely used WordPress form plugin, allowing unauthenticated attackers to potentially inject malicious code. This could allow unauthorized access to and manipulation of the affected systems. The primary concern is to confirm if this plugin is in use and to understand the potential exposure.

Code injection flaw in a popular WordPress form plugin.
Unauthenticated remote code execution risk.
Confirm usage and assess exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a web server hosting the vulnerable component. This allows them to inject and execute arbitrary PHP code, potentially leading to a complete compromise of the server.

No authentication required.
Triggered by sending malicious data.
Can lead to full server compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on a server when a vulnerable version of the Forminator plugin is used and the plugin is configured in a way that supports the deserialization of untrusted data. This could affect the confidentiality, integrity, and availability of the affected system.

Server-side code execution.
Unauthenticated remote code injection.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated PHP Object Injection vulnerability in Forminator affects public-facing websites, implicating application owners, platform teams, and security teams. The immediate priority is to identify all instances of the affected plugin, assess their exposure and business criticality, and confirm ownership to prioritize remediation efforts.

Application owners should prioritize this.
Verify plugin reachability and business impact.
Plan coordinated vendor and maintenance action.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Forminator WordPress plugin?

Forminator is a popular WordPress plugin designed to create custom contact forms, payment gateways, and interactive polls. By allowing site visitors to input data, it serves as a critical bridge between public users and your server's backend processes, which is why it must securely handle all incoming data.

What does PHP Object Injection mean for CVE-2026-66583?

This vulnerability, classified as CWE-502 (Deserialization of Untrusted Data), occurs when the plugin processes data from a user without sufficient validation. Because the plugin blindly trusts this input, an attacker can manipulate objects within the application's memory to execute unauthorized PHP code, potentially taking control of the server.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specially crafted request to the web server that hosts the plugin. The bug is specifically tied to the unsafe deserialization process; simply visiting the site or viewing a form does not automatically trigger it. The malicious payload must be intentionally submitted through the plugin's data processing path.

Do I need to worry if my Forminator plugin is not internet-facing?

Halo Surface Signal notes that this plugin is typically deployed on public-facing websites to collect input, making the vulnerable endpoint reachable via the internet. If your instance is strictly internal and not accessible to outside traffic, the likelihood of an unauthenticated remote attacker reaching the vulnerable component is significantly reduced.

What should I do first to address this vulnerability?

Your first step is to confirm which websites in your environment have the Forminator plugin active and check their version numbers. Once you have an inventory, prioritize updating the plugin to a version beyond 1.57.0. If an update is not immediately possible, consider temporarily disabling the plugin to mitigate the risk of remote code execution.

References

patchstack.com/database/wordpress/plugin/forminator/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.