EUVD-2026-94525
GHSA-c8r6-xr3r-r5hf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network request to a WordPress plugin endpoint (AV:N/AC:L/PR:N/UI:N); missing authorization permits data modification only, so I:H with C:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Forminator: from n/a through 1.57.2.
AnalysisAI
Missing authorization in the WPMU DEV Forminator WordPress plugin (all versions through 1.57.2) allows unauthenticated remote attackers to perform privileged actions that should require an access-control check, altering site data with a high integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, exploitation requires only that a vulnerable Forminator installation be network-reachable; no credentials or victim interaction are needed, though the impact is confined to integrity with no confidentiality or availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a vulnerable Forminator installation (versions through 1.57.2) be running and network-reachable; per AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or special configuration is stated as required, matching a broken/missing access-control check reachable by unauthenticated requests against default deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority, broadly-reachable flaw rather than an urgent emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the primary action is to upgrade Forminator to the first release later than 1.57.2 as soon as WPMU DEV publishes it, and to verify the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-2-broken-access-control-vulnerability?_s_id=cve) and the vendor's own changelog before assuming exposure is closed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress sites for the WPMU DEV Forminator plugin and identify any instance running version 1.57.2 or earlier; for affected sites, deploy WAF/virtual patching to block unauthenticated requests to Forminator endpoints, restrict access to wp-admin and plugin paths, and enable detailed logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator
View allThe Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and includ
The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevat
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today