What is the CVSS score of CVE-2026-66583?

CVE-2026-66583 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Forminator are affected by CVE-2026-66583?

The Forminator WordPress plugin (versions through 1.57.0 by WPMU DEV) contains a critical unauthenticated remote code execution vulnerability allowing attackers to compromise affected websites…

How to fix or mitigate CVE-2026-66583?

Within 24 hours, audit all WordPress installations to identify those running Forminator plugin version 1.57.0 or earlier and prioritize internet-facing instances for immediate action. Within 7 days, implement Web Application Firewall rules to detect and block PHP object injection attempts targeting Forminator endpoints, establish log monitoring for exploitation attempts, and begin evaluation of alternative form plugins to reduce long-term risk. Within 30 days, either migrate to an alternative WordPress form solution or disable Forminator entirely on non-critical deployments; contact WPMU DEV security team to confirm patch timeline and interim security guidance.

Forminator CVE-2026-66583

EUVD-2026-63332 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-20 Patchstack

GHSA-f837-mqhp-xxmg

PHP WordPress Deserialization Forminator Wordpress Plugin Wpmu Dev

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N) network form input reaches unsafe deserialization with no user interaction; object injection can yield full C/I/A impact via a gadget chain, though impact is chain-dependent.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 12:35 vuln.today

CVE Published

Aug 20, 2026 - 12:06 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

Articles & Coverage 1

News Critical PHP Object Injection in Forminator WordPress Plugin - CVE-2026-66583 Aug 21, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.57.0, letting remote attackers submit crafted serialized data that is deserialized without validation to potentially achieve arbitrary object instantiation and, with a suitable POP gadget chain, remote code execution. The vulnerability carries a CVSS 9.8 rating with a fully unauthenticated network vector and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Forminator is a form-builder plugin for WordPress that accepts and processes user-submitted form data. The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controllable input into PHP's unserialize() (or an equivalent deserialization path) without integrity or type validation. When PHP unserializes attacker-controlled data, magic methods such as __wakeup() and __destruct() fire on the reconstructed objects; if any loaded class (in WordPress core, the plugin, or another active plugin) provides a usable 'POP gadget' chain, this can escalate from object injection to file writes, SQL injection, or arbitrary code execution. The affected component is identified by CPE cpe:2.3:a:wpmu_dev:forminator:*, i.e. the wpmu_dev Forminator plugin across all versions matching the wildcard up to the fixed release.

RemediationAI

Upgrade Forminator to the vendor's fixed release above 1.57.0 as soon as it is available; the exact patched version is not confirmed in the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-0-php-object-injection-vulnerability) and the WPMU DEV changelog for the specific fixed version before deploying. Upstream fix availability is not independently confirmed from the input. Until patched, apply a virtual patch / WAF rule (Patchstack or equivalent) to block serialized PHP payloads in Forminator form submissions, restrict or disable exposed Forminator forms on public-facing pages, and monitor for unexpected object-injection signatures in POST data; note that blocking serialized-looking input may cause false positives on legitimate submissions containing curly braces or colons, and disabling forms reduces site functionality.