A privilege escalation flaw in the Forminator Forms WordPress plugin version before 1.57.0.5 allows a site administrator on a multisite network to execute arbitrary code across the entire network. The vulnerability arises because a network‑wide setting is not properly restricted to network administrators, giving an attacker the ability to bypass normal permissions and gain full control of all sites on the multisite installation. This leads to a complete compromise of confidentiality, integrity, and availability for the affected network.

The vulnerability affects the Forminator Forms plugin for WordPress, specifically any installation running a version earlier than 1.57.0.5 on a multisite network. The consumer is a WordPress site with multisite enabled, where any site administrator can exploit the flaw.

The CVSS score is not provided, but the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal to the network: a site administrator can trigger the exploit through normal plugin interfaces. As the flaw allows arbitrary code execution without additional prerequisites other than administrative rights on a single site, the risk is high for networks with many sites or where site administrators have substantial privileges. Due to the lack of detection metrics, this vulnerability could be overlooked unless active monitoring or immediate patching is performed.