Skip to main content

Forminator CVE-2026-96336

| EUVDEUVD-2026-95589 HIGH
Authentication Bypass by Spoofing (CWE-290)
2026-10-09 Patchstack
WordPress Authentication Bypass Forminator Wordpress Plugin
7.5
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
7.5 HIGH

Remote unauthenticated spoofing of a public form with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is integrity-only (forged identity/payment), so C:N/I:H/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Oct 09, 2026 - 10:52 vuln.today
CVE Published
Oct 09, 2026 - 10:00 cve.org
HIGH 7.5

DescriptionCVE.org

Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

AnalysisAI

Authentication bypass in WPMU DEV Forminator (versions up to 1.57.2) allows unauthenticated remote attackers to spoof identity and bypass payment or other identity-dependent workflows on WordPress sites. The vulnerability requires a publicly reachable form-typically a payment-enabled or identity-verifying form-to be active. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a publicly reachable Forminator form on a WordPress site running version 1.57.2 or earlier; based on the reference, the affected feature is most likely a payment-enabled or identity-dependent form, so a site with no such form configured is not meaningfully exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuinely exploitable but impact-limited issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Update the Forminator plugin to a version later than 1.57.2; the exact fixed version is not specified in the provided data, but a patch is available per the vendor advisory (see https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-2-payment-bypass-vulnerability?_s_id=cve). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all WordPress sites running WPMU DEV Forminator versions up to 1.57.2 and identify publicly reachable payment-enabled or identity-verifying forms; consider temporarily disabling those forms or restricting access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Forminator

View all
CVE-2023-4596 CRITICAL POC
9.8 Aug 30

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after

CVE-2024-7389 HIGH POC
7.5 Aug 02

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
CVE-2019-9568 MEDIUM POC
6.5 Mar 04

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
CVE-2023-3134 MEDIUM POC
6.1 Jul 31

The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
CVE-2019-9567 MEDIUM POC
6.1 Mar 04

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
CVE-2026-66583 CRITICAL
9.8 Aug 20

Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and includ
CVE-2021-4417 MEDIUM POC
5.4 Jul 12

The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
CVE-2025-6463 HIGH
8.8 Jul 02

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary

CVE-2026-28111 HIGH
8.8 Aug 06

Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevat
CVE-2023-5119 MEDIUM POC
4.8 Nov 20

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
CVE-2021-24700 MEDIUM POC
4.8 Nov 23

The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
CVE-2025-6464 HIGH
7.5 Jul 02

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2026-76423 CRITICAL
10.0
CVE-2025-66570 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-96336 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy