What is the CVSS score of EUVD-2026-43427?

EUVD-2026-43427 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of Forminator are affected by EUVD-2026-43427?

The Forminator WordPress plugin (versions up to 1.55.0.2) contains a security vulnerability that allows unauthenticated attackers to download sensitive server files including wp-config.php, which…

How to fix or mitigate EUVD-2026-43427?

Within 24 hours: Inventory all WordPress installations using Forminator and immediately disable or remove the plugin. Within 7 days: Review access logs for evidence of exploitation (unusual requests to wp-config.php or other sensitive files), change all database and API credentials, and monitor for unauthorized database access patterns. Within 30 days: Monitor WPMU DEV security advisories for patch availability; if no patch is released, evaluate alternative form plugin solutions or implement persistent Web Application Firewall rules blocking suspicious file access requests.

Forminator EUVD-2026-43427

| CVE-2026-57815 HIGH

Path Traversal (CWE-22)

2026-07-13 Patchstack

Path Traversal WordPress Forminator

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable download endpoint (AV:N/AC:L/PR:N/UI:N) enabling arbitrary file read gives high confidentiality impact only, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:23 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.

Articles & Coverage 2

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jul 13, 2026

AnalysisAI

Arbitrary file download via path traversal in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.55.0.2, letting remote unauthenticated attackers read files outside the intended directory (CVSS 7.5, confidentiality-only). The Patchstack reference characterizes this as an arbitrary file download flaw, meaning sensitive server files such as wp-config.php could be exfiltrated. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify site running Forminator ≤1.55.0.2

Delivery

Send request with ../ traversal to download endpoint

Exploit

Bypass directory restriction

Execution

Read arbitrary server file

Impact

Exfiltrate wp-config.php credentials

Access

Identify site running Forminator ≤1.55.0.2

Delivery

Send request with ../ traversal to download endpoint

Exploit

Bypass directory restriction

Execution

Read arbitrary server file

Impact

Exfiltrate wp-config.php credentials

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the vulnerable Forminator file-download/export handler is reachable - i.e., the plugin is installed and active on an internet-facing WordPress site running any version through 1.55.0.2. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which is a genuine priority profile for an internet-facing WordPress plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker sends a crafted HTTP request to the vulnerable Forminator file-download endpoint with a traversal payload in the path parameter (e.g., ../../../../wp-config.php) and retrieves the file contents in the response. Using the disclosed database credentials and authentication salts, the attacker then pivots to the WordPress database or forges sessions. …
Remediation	Upgrade Forminator to the first release above 1.55.0.2 (the fixed version is not specified in the provided data - confirm the exact patched build via the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/forminator/vulnerability/wordpress-forminator-plugin-1-55-0-2-arbitrary-file-download-vulnerability and the WPMU DEV changelog before deploying). … Detailed patch versions, workarounds, and compensating controls in full report.