WPMU DEV Forminator CVE-2026-108486

Requires a target running WPMU DEV Forminator from an unspecified early version through 1.58.0, reachable over the network (HTTP). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special attack complexity are needed against an affected installation. The input does not name the exact vulnerable endpoint, form feature, or configuration, so the precise prerequisite cannot be stated beyond 'plugin installed and active at an affected version'; the title 'Broken Access Control' combined with PR:N suggests an access-control check is missing on an otherwise reachable request. Limiting factors: impact is confined to low confidentiality disclosure (I:N/A:N), so exploitation exposes data but does not directly modify the site or cause outages; sites on a patched release above 1.58.0 are not affected.

This is a medium-severity (CVSS 5.3) missing authorization flaw (CWE-862) in the WPMU DEV Forminator WordPress plugin. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, but with only low confidentiality impact and NO integrity or availability impact - consistent with a broken-access-control issue that exposes data rather than enabling takeover. No EPSS score was provided in the input, so the empirical exploitation probability cannot be stated. KEV status is not present (not CISA-listed), and no POC/exploit-code signal is included in the data, so there is no confirmed active exploitation or public exploit. No SSVC decision data was supplied. Overall this reads as a genuine but moderate priority: the unauthenticated network vector lowers the exploitation barrier, yet the limited (confidentiality-only, low) impact and absence of KEV/EPSS/POC signals argue against treating it as an emergency. Note a mild tension - the vendor-assigned vector claims PR:N (unauthenticated) while the title is 'Broken Access Control'; verify with the Patchstack advisory whether some endpoints still require a logged-in subscriber-level session.

A remote, unauthenticated attacker sends crafted HTTP requests to a Forminator AJAX/REST endpoint that fails to enforce an authorization check, retrieving or acting on data they should not be able to reach. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, no special timing, and no victim interaction are needed. No public proof-of-concept exploit is identified in the provided data.