Forminator CVE-2026-57815

Exploitation requires that the vulnerable Forminator file-download/export handler is reachable - i.e., the plugin is installed and active on an internet-facing WordPress site running any version through 1.55.0.2. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special non-default configuration stated as required; the limiting factor is that the affected download endpoint must be accessible and the target file must be readable by the web server user (typically the case for wp-config.php and other WordPress files). No specific plugin feature toggle is named in the source data as a precondition.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which is a genuine priority profile for an internet-facing WordPress plugin. Impact is scoped to confidentiality only (C:H/I:N/A:N): an attacker can read files but not modify or crash the system, matching an arbitrary file download rather than full compromise - though disclosure of wp-config.php (DB credentials, auth salts) can enable escalation to broader takeover. No EPSS score, SSVC decision, POC, or KEV signal was provided in the input, so real-world exploitation likelihood is unquantified; the high CVSS is driven by ease of access, not by any confirmed exploitation. Given Forminator's large install base, this is a realistic patch-soon item despite the absence of confirmed exploitation.

An unauthenticated attacker sends a crafted HTTP request to the vulnerable Forminator file-download endpoint with a traversal payload in the path parameter (e.g., ../../../../wp-config.php) and retrieves the file contents in the response. Using the disclosed database credentials and authentication salts, the attacker then pivots to the WordPress database or forges sessions. No public exploit was identified in the provided data, but the low complexity makes weaponization straightforward.