A critical vulnerability in the Forminator Forms plugin allows authenticated users with specific permissions to achieve remote code execution, posing a severe threat to site integrity.

This vulnerability involves improper control of code generation (CWE-94) where the plugin fails to restrict instantiated classes during XML-RPC deserialization. It requires an attacker to possess the forms-management permission, which can be assigned to roles lower than administrator.

Successful exploitation allows an attacker to write arbitrary files to the server and execute code, leading to a total compromise of the affected web application. Given the CVSS score of 8.5, this high-severity flaw enables full system control, potential data theft, and the ability to persist malicious activity within the hosting environment.

Immediate Action: Update the Forminator Forms plugin to version 1.57.2.1 or later immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor server logs for unusual XML-RPC requests and unexpected file creation events within the WordPress installation directory.

Compensating Controls: If immediate patching is not feasible, consider disabling XML-RPC functionality if it is not required for site operations, or restrict access to the affected plugin settings to highly trusted accounts only.

Public Exploit Available: No (exploit_available unknown).

The risk posed by this vulnerability is significant, as it grants attackers the ability to execute code on the underlying server. Administrators must prioritize updating the Forminator Forms plugin to version 1.57.2.1 to neutralize the threat. Failure to patch may result in a full site takeover by attackers who successfully escalate their privileges or compromise accounts with form management capabilities.