CVE-2026-6222 — The Forminator Forms plugin for WordPress is vulnerable to

title: CVE-2026-6222 - Forminator Forms Plugin Unauthorized Module Actions
id: scw-2026-05-07-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-6222 by targeting the Forminator Forms plugin's `processRequest()` method via `admin-ajax.php`. This rule specifically looks for POST requests to `admin-ajax.php` with the `action` parameter set to `forminator_process_request` and a URI that indicates the vulnerable file path. This bypasses authorization checks for sensitive module management actions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6222/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-method:
          - 'POST'
      uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=forminator_process_request'
  selection_indicators:
      uri|contains:
          - 'admin/abstracts/class-admin-module-edit-page.php'
      condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse