What is the CVSS score of EUVD-2026-11926?

EUVD-2026-11926 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Forminator are affected by EUVD-2026-11926?

CVE-2026-32409 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-11926?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Forminator EUVD-2026-11926

| CVE-2026-32409 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass Forminator Wordpress Plugin Wpmu Dev Your All In One Wordpress Platform

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11926

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through <= 1.50.2.

AnalysisAI

Forminator through version 1.50.2 contains an authorization bypass that allows unauthenticated attackers to modify data through incorrectly configured access controls. The vulnerability affects WordPress sites using the WPMU DEV Forminator plugin and requires no user interaction to exploit. No patch is currently available for this issue.

Technical ContextAI

The vulnerability resides in the WPMU DEV Forminator WordPress plugin, a form-building and management extension identified by CPE string cpe:2.3:a:wpmu_dev:forminator. The root cause is classified under CWE-862 (Missing Authorization), which occurs when an application fails to properly verify user permissions before executing sensitive operations. WordPress plugins interact with the wp-admin and REST API endpoints; Forminator's authorization checks appear insufficient at one or more form submission, editing, or configuration endpoints. The plugin likely lacks proper capability checks via WordPress's is_user_logged_in() and current_user_can() functions, or the REST API endpoints do not validate nonces or user roles before processing form-related actions.

RemediationAI

Immediately upgrade WPMU DEV Forminator to version 1.50.3 or later, which addresses the authorization flaw. In WordPress Dashboard, navigate to Plugins > Installed Plugins, locate Forminator, and click Update if available; alternatively, download the patched version from wordpress.org/plugins/forminator and reinstall. Until patching is completed, temporarily restrict form submissions by disabling affected forms if they handle sensitive data, or implement an additional layer of WordPress role-based access control by limiting form visibility to authenticated users only via plugin settings. Verify that the plugin's capability checks align with WordPress security best practices by reviewing the changelog and security advisory from WPMU DEV. Conduct a security audit of any forms that were live during the vulnerable period to detect unauthorized modifications.