EUVD-2026-53941
GHSA-p66m-599j-249c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-delivered exploit requiring only a Contributor account (PR:L); no special conditions (AC:L); full C/I/A reflects admin-level takeover potential post-escalation.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.
AnalysisAI
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user session with at minimum the Contributor role (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 and reflects a network-reachable attack with low complexity requiring only Contributor-level authentication - a role often granted to untrusted or semi-trusted users in multi-author WordPress sites, community platforms, and content networks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a WordPress account with the Contributor role - commonly available on multi-author blogs, community sites, or publications that allow guest contributors. Using this low-privilege account, the attacker sends a crafted request to a Forminator-exposed endpoint or AJAX handler that lacks proper capability checks, triggering incorrect privilege assignment and gaining Editor or Administrator-level access. … |
| Remediation | Update the Forminator plugin to a version above 1.56.0 immediately, as the fix version has not been independently confirmed from available data - check the WordPress plugin repository or WPMU DEV dashboard for the latest patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately deactivate the Forminator plugin (≤1.56.0) on all affected WordPress installations to eliminate the attack surface and audit contributor account activity for unauthorized privilege changes in the past 90 days. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator
View allThe Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and includ
The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object
The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. Rated high s
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today