The vulnerability exists in the Forminator Forms WordPress plugin prior to version 1.57.0.7. Users who have the capability to create forms can manipulate a registration form so that any visitor who registers through it is granted the administrator role. The weakness lies in inconsistent enforcement of role restrictions, allowing a privileged user to elevate a visitor's permissions to the highest level, effectively giving full administrative access to the entire WordPress installation. This attack can compromise confidentiality, integrity, and availability of site data and functions.

Affected systems include WordPress sites that have the Forminator Forms plugin installed at a version earlier than 1.57.0.7. The issue is specific to the plugin's registration form feature, and any site configuration that permits form creation by non‑administrator users with that capability is vulnerable.

The CVSS score is not provided, but the lack of restriction on role assignment poses a high impact scenario. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. The likely exploit path involves a legitimate user gaining form‑building rights, then crafting a registration form to assign the administrator role, and finally having a visitor register through that form. The attacker must have form‑creation access but does not need broader system access to succeed.