{
 "id": "WPSEC-2026-2183",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2183/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2183/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2183/index.md",
 "title": "Forminator Forms <= 1.58.3 - Unauthenticated Manual Registration Approval Bypass via Merge Tag Injection in Form Field Values",
 "description": "The Forminator Forms plugin for WordPress is vulnerable to Merge Tag Injection leading to a manual registration approval bypass via submitted form field values in all versions up to, and including, 1.58.3. This is due to the plugin expanding merge tags such as {account_approval_link} that appear inside user-submitted values after those values are placed into notification email bodies, combined with the account activation handler creating the user account before checking whether the requester may approve registrations that use manual approval. This makes it possible for unauthenticated attackers to obtain the approval link for their own pending registration in a notification they receive and use it to activate their account with the role configured in the form, bypassing administrator approval. Exploitation requires a registration form set to manual approval whose notification to the registrant includes submitted field values.",
 "plugin": {
  "slug": "forminator",
  "name": "Forminator Forms",
  "full_name": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/forminator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/forminator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/forminator"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.58.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.58.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.58.4",
 "remediation": "Update to 1.58.4 or later.",
 "fix_released": "2026-11-02T10:11:37+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:19:07.910864+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2183/",
  "https://plugins.svn.wordpress.org/forminator/tags/1.58.4/",
  "https://wordpress.org/plugins/forminator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/forminator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}