Forminator EUVD-2026-96405

The affected component is the WPMU DEV Forminator plugin at any version from initial release through 1.57.3; sites must be running a vulnerable version of this specific plugin. The described flaw is an incorrect privilege assignment enabling privilege escalation. Per the supplied CVSS vector the attack is network-based with low complexity and no user interaction, and PR:N implies no authentication is required against a default Forminator installation; however, because CWE-266 privilege escalation typically requires an existing (low-privilege) account, defenders should confirm whether a registered user role is a precondition. No specific non-default feature or configuration setting is named in the description.

This is a genuine prioritization concern but with important caveats. The Patchstack-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, base 8.2) describes a network-reachable, low-complexity, unauthenticated flaw with high integrity impact - consistent with a serious privilege-escalation issue in a widely deployed WordPress plugin. However, the signals are thin: no EPSS probability, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation. There is also an internal tension worth flagging: the weakness is CWE-266 (Incorrect Privilege Assignment) leading to 'Privilege Escalation,' which normally presupposes an attacker already holds some account, yet the vector asserts PR:N (unauthenticated) - verify with the vendor/Patchstack advisory whether a low-privilege account (e.g., subscriber) is actually required. Net: treat as a high-severity patch-soon item for Forminator operators, but the absence of KEV/EPSS/POC suggests it is not yet under widespread exploitation.

An attacker interacts with the Forminator plugin over the network (AV:N, AC:L, no user interaction) and abuses the incorrect privilege assignment to grant themselves or manipulate capabilities beyond what they should hold, resulting in high integrity impact and limited availability impact. If the vendor's PR:N rating holds, this is achievable without authentication; if a low-privilege account is actually needed, a registered subscriber could perform the escalation. No public exploit code was identified at time of analysis.