CVE-2026-19222

{"id": "CVE-2026-19222", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19222", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-23T15:26:41.613946Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Forminator Forms", "versions": [{"status": "affected", "version": "0", "lessThan": "1.57.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-22T06:16:16.383", "references": [{"url": "https://wpscan.com/vulnerability/bb3997c6-4d9a-46f6-85d7-d472dfc00829/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it."}, {"lang": "es", "value": "El plugin de WordPress Forminator Forms anterior a la versi\u00f3n 1.57.0.7 no impone de manera consistente la restricci\u00f3n de rol que aplica a los formularios de registro, permitiendo a los usuarios autorizados a crear formularios configurar uno que asigna el rol de administrador a cualquier visitante que se registre a trav\u00e9s de \u00e9l."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "contact@wpscan.com"}