What is the CVSS score of CVE-2026-57815?

CVE-2026-57815 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Forminator are affected by CVE-2026-57815?

The Forminator WordPress plugin (versions up to 1.55.0.2) contains a security vulnerability that allows unauthenticated attackers to download sensitive server files including wp-config.php, which…

How to fix or mitigate CVE-2026-57815?

Within 24 hours: Inventory all WordPress installations using Forminator and immediately disable or remove the plugin. Within 7 days: Review access logs for evidence of exploitation (unusual requests to wp-config.php or other sensitive files), change all database and API credentials, and monitor for unauthorized database access patterns. Within 30 days: Monitor WPMU DEV security advisories for patch availability; if no patch is released, evaluate alternative form plugin solutions or implement persistent Web Application Firewall rules blocking suspicious file access requests.

Forminator CVE-2026-57815

EUVD-2026-43427 HIGH

Path Traversal (CWE-22)

2026-07-13 Patchstack

Path Traversal WordPress Forminator

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable download endpoint (AV:N/AC:L/PR:N/UI:N) enabling arbitrary file read gives high confidentiality impact only, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:23 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.

Articles & Coverage 2

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jul 13, 2026

AnalysisAI

Arbitrary file download via path traversal in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.55.0.2, letting remote unauthenticated attackers read files outside the intended directory (CVSS 7.5, confidentiality-only). The Patchstack reference characterizes this as an arbitrary file download flaw, meaning sensitive server files such as wp-config.php could be exfiltrated. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Forminator is a widely used form-builder plugin for WordPress that handles submissions, file uploads, quizzes, and polls. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): a user-controlled path parameter - consistent with a file download/export endpoint per the Patchstack 'arbitrary file download' classification - is not properly canonicalized or constrained to an allowed base directory, so traversal sequences (e.g., ../../) escape into arbitrary filesystem locations. The single CPE identifies the affected package as cpe:2.3:a:wpmu_dev_-_your_all-in-one_wordpress_platform:forminator, running within the PHP/WordPress request-handling stack.

RemediationAI

Upgrade Forminator to the first release above 1.55.0.2 (the fixed version is not specified in the provided data - confirm the exact patched build via the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/forminator/vulnerability/wordpress-forminator-plugin-1-55-0-2-arbitrary-file-download-vulnerability and the WPMU DEV changelog before deploying). Until patched, restrict access to Forminator's file download/export endpoints via web server rules or a WAF that blocks path-traversal patterns (encoded and literal ../ sequences) in query parameters, which may interfere with legitimate submission-export functionality and should be tested. As a stronger interim control, deactivate the Forminator plugin if forms are non-critical, accepting the loss of form functionality, and ensure filesystem permissions limit the web user's read access to only required paths.