Forminator CVE-2026-106611

Exploitation requires an authenticated WordPress user - realistically an administrator - to hold an active session and be induced to visit an attacker-controlled page or link while logged in (UI:R). The underlying condition is the plugin's missing or inadequate CSRF nonce validation on one or more state-changing Forminator endpoints in versions through 1.57.3. Limiting factors: the attack fails without victim interaction, cannot succeed if the targeted user is not currently authenticated, and only affects sites running Forminator at or below 1.57.3; the specific vulnerable action/endpoint is not detailed in the advisory.

This is a moderate-severity CSRF flaw (CVSS 7.1) whose risk is bounded by its reliance on victim interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms an unauthenticated network-based attack with low complexity, but UI:R means success depends on tricking an authenticated user - typically a logged-in administrator - into triggering a forged request, so this is not a wormable or self-propagating issue. Impact is asymmetric: high integrity impact (I:H) with only low confidentiality (C:L) and no availability impact (A:N), consistent with CWE-352 where an attacker forces state-changing actions rather than reading or crashing data. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied in the input, so exploitation probability cannot be quantified - the only intelligence source is a single Patchstack advisory. Treat this as a real but second-tier patching priority: it is not confirmed exploited and requires social engineering of a privileged user, so it ranks below any unauthenticated-no-interaction RCE but still warrants prompt updating on sites with active admin sessions.

An attacker crafts a malicious web page or email link containing a forged state-changing request to a vulnerable Forminator endpoint and lures a logged-in WordPress administrator into visiting it. Because the plugin does not validate an anti-CSRF nonce, the victim's browser silently submits the request with the admin's authenticated session cookies, performing an unauthorized configuration or data-modifying action. No public exploit identified at time of analysis, and the attack cannot proceed without the victim's browser interaction.