What is the CVSS score of CVE-2026-28111?

CVE-2026-28111 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Forminator are affected by CVE-2026-28111?

The Forminator WordPress plugin (version 1.56.0 and earlier) contains a privilege escalation vulnerability affecting any WordPress deployment using this plugin.

How to fix or mitigate CVE-2026-28111?

Within 24 hours, immediately deactivate the Forminator plugin (≤1.56.0) on all affected WordPress installations to eliminate the attack surface and audit contributor account activity for unauthorized privilege changes in the past 90 days. Within 7 days, evaluate alternative form-builder plugins and implement role-based access controls to restrict who holds Contributor-level privileges; document the business justification for any Contributor accounts that must remain active. Within 30 days, monitor the Forminator vendor advisory for patch release; if no patch becomes available, complete migration to a patched alternative or establish permanent compensating controls with enhanced monitoring for privilege escalation events.

Forminator CVE-2026-28111

EUVD-2026-53941 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-06 Patchstack

GHSA-p66m-599j-249c

WordPress Privilege Escalation Forminator Wordpress Plugin Wpmu Dev

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered exploit requiring only a Contributor account (PR:L); no special conditions (AC:L); full C/I/A reflects admin-level takeover potential post-escalation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:19 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 8.8

DescriptionCVE.org

Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

AnalysisAI

Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevate their privileges to a higher role, potentially achieving administrative control over the WordPress installation. The flaw, rooted in CWE-266 (Incorrect Privilege Assignment), carries a CVSS score of 8.8 and a full High C/I/A impact rating, indicating that successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected site. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-privilege entry bar and network accessibility make this an elevated priority for WordPress deployments using this plugin.

Technical ContextAI

Forminator (CPE: cpe:2.3:a:wpmu_dev:forminator:*:*:*:*:*:*:*:*) is a feature-rich drag-and-drop form builder plugin for WordPress developed by WPMU DEV. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin fails to properly enforce role-based access controls - likely permitting a Contributor-level WordPress user (a role that normally has only limited post-creation rights with no publish capability) to invoke restricted functionality or modify privileged data structures that should require higher roles such as Editor, Administrator, or Super Admin. This class of flaw typically arises when REST API endpoints, AJAX handlers, or admin-side actions lack proper capability checks (e.g., current_user_can()) or rely on insufficient nonce validation tied to low-privilege roles.

RemediationAI

Update the Forminator plugin to a version above 1.56.0 immediately, as the fix version has not been independently confirmed from available data - check the WordPress plugin repository or WPMU DEV dashboard for the latest patched release. Until a verified patched version is confirmed, site administrators should restrict Contributor role registration and audit existing Contributor accounts for signs of unauthorized privilege escalation. As a compensating control, consider temporarily removing the Contributor role assignment from untrusted users or using a role management plugin to further restrict Contributor capabilities. Sites that do not require the Contributor role for operations should revoke it from all non-essential accounts to eliminate the attack surface entirely. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-56-0-privilege-escalation-vulnerability should be monitored for patch version confirmation.