EUVD-2026-96513
GHSA-9pcm-jc8x-ggj7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress site over HTTP
-
DeliverySend crafted request to Forminator action
-
ExploitBypass missing authorization check (CWE-862)
-
ExecutionDelete arbitrary content/entries
-
ImpactData loss and integrity impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond reachability - the vulnerability is exploitable by remote unauthenticated attackers (PR:N/UI:N) against affected Forminator installations at or below version 1.57.3 running on a WordPress site. The flaw is a missing authorization check (CWE-862) on a content-deletion action, so the only prerequisite is that the vulnerable plugin is installed and active and its endpoint is network-reachable. Limiting factors: impact is confined to destructive deletion of plugin-managed content (no confidentiality disclosure or code execution), and sites that have upgraded past 1.57.3 or do not run Forminator are unaffected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction - a profile that, combined with CWE-862 (Missing Authorization) and the 'Unauthenticated Arbitrary Content Deletion' description, indicates genuinely trivial reachability. However, the published vector reports availability-only impact (A:H) while the described behavior is destruction/deletion of content, which is more naturally an integrity impact (unauthorized modification/deletion of data); this signal conflict should be verified - see assessed vector below. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is currently no public exploit identified at time of analysis and no evidence of active or at-scale exploitation. The practical risk is therefore moderate-to-elevated: easy to trigger and affecting a very widely installed WordPress plugin, but with impact limited to destructive loss of content (no confidentiality or code-execution component) and no confirmed exploitation activity. Prioritize patching because of the unauthenticated network-facing attack surface, but this is not yet an in-the-wild emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running a vulnerable Forminator version (<= 1.57.3), invoking a plugin action that lacks a proper authorization/capability check, and causes deletion of arbitrary content such as form submissions or associated entries. Because AV:N/AC:L/PR:N/UI:N applies, this requires only reachability of the site with no login, credentials, or victim interaction. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated remote attackers can delete arbitrary plugin-managed content on any WordPress site running the Forminator form-builder plugin at or below version 1.57.3, because the content-deletion action lacks an authorization check (CWE-862 Missing Authorization). The flaw is trivially reachable: our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (published base 7.5), meaning no credentials, no privileges and no user interaction are required - only that the plugin is installed, active and its endpoint is network-reachable. Impact is destructive only (forms/submissions and associated content can be wiped) with no confidentiality disclosure or code execution, and no public exploit code was identified at time of analysis; there is no CISA KEV listing and no EPSS data was supplied. Sites that have upgraded past 1.57.3 or that do not run Forminator are unaffected.
RemediationAI
No vendor-released patch version is identified in the available intelligence for this CVE; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-3-arbitrary-content-deletion-vulnerability) and the WPMU DEV plugin page/changelog to confirm the fixed release, and upgrade Forminator as soon as a version above 1.57.3 is available - that is the only complete fix, since the defect is a missing authorization check in the plugin's own deletion handler. If an immediate upgrade is not possible, the most effective compensating control is to temporarily deactivate Forminator; the trade-off is total loss of form functionality and loss of already-collected form data rendering until the plugin is restored. Alternatively, deploy a WAF or virtual-patching rule that blocks unauthenticated requests targeting the plugin's deletion action (for example requests to wp-admin/admin-ajax.php or the plugin's REST namespace carrying the forminator deletion action parameters) from any source that does not present a valid authenticated WordPress session; the trade-off is that overly broad admin-ajax.php filtering can break legitimate front-end form submissions and other plugins that rely on the same endpoint, so rules should be scoped to the specific action name and tuned in monitor mode first. Because the flaw requires no privileges or user interaction, restricting network access to the WordPress administrative endpoints (IP allow-listing, blocking admin-ajax.php writes from untrusted networks) is a useful secondary control but will not protect publicly exposed front-end forms that legitimately use the same dispatch path. As no public exploit code was identified at time of analysis, this is a preventative priority rather than an active-incident response; nevertheless, sites unable to patch should keep full database backups and verify integrity of Forminator-stored content for signs of unexpected deletion.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Forminator is a WordPress form-builder plugin published by WPMU DEV (tracked as CPE cpe:2.3:a:wpmu_dev:forminator:*:*:*:*:*:*:*:*) that stores forms, submissions and related content in the site's database and exposes them for management through WordPress AJAX/REST endpoints. The root cause is CWE-862, Missing Authorization: the deletion handler performs its destructive action without verifying that the caller holds the appropriate WordPress capability (and effectively without the nonce/authorization gate that would normally bind such a request to an authenticated administrator). Because the request is processed server-side as part of the normal plugin action dispatch, an unauthenticated remote party who can reach the endpoint can pass the parameters the handler expects and have stored content removed. This is classified as an access-control design defect rather than an injection or memory-safety bug, so no special preconditions (no admin session, no crafted file, no user browsing) are needed. Our assessment records the impact as integrity (I:H) on a network/low-complexity/PR:N/UI:N vector rather than availability-only, which is consistent with permanent destruction of stored plugin content; the referenced Patchstack advisory (https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-3-arbitrary-content-deletion-vulnerability) is the primary source of record.
Know when Forminator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated, network, low-complexity (AV:N/AC:L/PR:N/UI:N) per the missing-authorization design; arbitrary content deletion is unauthorized data destruction, so I:H rather than the input's A:H, with no confidentiality impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
Executive ViewAI
WordPress sites running the Forminator form-builder plugin at or below version 1.57.3 can have their forms, submissions, and associated content deleted by an unauthenticated remote attacker. No credentials or user interaction are required, and no vendor patch is currently available, so exposure spans any marketing, customer-intake, or lead-capture workflow built on the plugin. Leadership should prioritize asset inventory and interim containment because the primary harm is permanent loss of business data rather than a confidentiality breach.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: deactivate or remove the Forminator plugin on any site where it is not business-critical; otherwise use WAF or reverse-proxy virtual patching to block unauthenticated requests to the plugin's content-deletion action and restrict wp-admin/admin-ajax.php to trusted networks or IP allowlists; enforce MFA and least privilege for WordPress administrators; confirm offline, immutable, and restore-tested backups of forms and submissions; and monitor and alert on bulk deletion or anomalous admin-ajax activity so destructive attempts can be detected and recovered quickly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Forminator
View allThe Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and includ
The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevat
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
Privilege escalation in the WPMU DEV Forminator WordPress plugin affects every release through 1.57.3 and lets an attack
Exploit-DB