A critical vulnerability in the Forminator Forms plugin allows authenticated site administrators to achieve remote code execution across an entire WordPress multisite network.

This is a code injection vulnerability (CWE-94) where the plugin fails to enforce proper capability checks for network-wide settings, allowing any authenticated user with site administrator privileges to execute arbitrary code.

The ability for a site-level administrator to execute arbitrary code across a multisite network represents a total compromise of the application environment. Given the CVSS score of 7.2, this vulnerability poses a significant risk to data integrity, confidentiality, and overall system availability, as an attacker could potentially gain full control over the entire network infrastructure.

Immediate Action: Update the Forminator Forms plugin to version 1.57.0.5 or later immediately.

Proactive Monitoring: Monitor server logs for suspicious PHP execution patterns and unusual administrative activity originating from non-network-level administrator accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to sensitive plugin settings and monitor for unauthorized configuration changes within the WordPress dashboard.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Forminator Forms within a WordPress multisite environment must prioritize updating to version 1.57.0.5 without delay. The risk of lateral movement and total code execution across the network necessitates immediate patching to prevent unauthorized administrative escalation and system-wide compromise.