WPMU DEV Forminator CVE-2026-116859

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required and exploitation is remote against affected installations of the Forminator plugin versions up to and including 1.58.3. However, the available sources do not describe the specific endpoint, feature, protocol, or configuration that triggers the missing-authorization flaw - the description only states it stems from incorrectly configured access control security levels. The limiting factor is the impact scope: only limited integrity is affected (C:N/I:L/A:N), so no data disclosure or service disruption results; the practical risk also depends on the site running Forminator ≤1.58.3 and exposing the affected functionality.

This is a moderate-severity, low-priority issue rather than an emergency. The CVSS 3.1 score of 5.3 reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N) flaw requiring no user interaction (UI:N), but with impact limited to integrity only (C:N/I:L/A:N) - meaning an attacker can make limited unauthorized modifications but cannot read confidential data or cause a denial of service. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent remediation timeline. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no proof-of-concept or exploit code is indicated in the input (only a Patchstack advisory reference exists), so there is no public exploit identified at time of analysis. The signals are internally consistent: a CWE-862 Missing Authorization bug with low integrity impact, reported by Patchstack, carrying a routine priority. The main caveat is that the description is generic and does not identify the specific affected endpoint or action, so the concrete real-world blast radius cannot be fully verified from available data.

A remote, unauthenticated attacker sends a crafted request directly to a Forminator plugin endpoint that fails to enforce an authorization check, allowing them to perform an action or modify data that should be restricted to privileged users. Because the attack is network-based with low complexity and no authentication or user interaction required, it can be automated against exposed WordPress sites, though the impact is confined to limited integrity changes. No public exploit code is identified at time of analysis.