Access Control Flaws in WPMU DEV Forminator Plugin
CVE-2026-108486

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Forminator
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108486?

An access control vulnerability exists in the WPMU DEV Forminator plugin that allows unauthorized access due to improperly configured security levels. This flaw can enable attackers to exploit the system by bypassing expected access controls. Specifically, it affects Forminator versions from n/a to 1.58.0, potentially leading to unauthorized data exposure or manipulation. Users are urged to assess their configurations and apply necessary updates to mitigate risks associated with this vulnerability.

Affected Version(s)

Forminator 0 <= 1.58.0

References

https://patchstack.com/database/wordpress/plugin/forminat...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrei | Patchstack Bug Bounty Program
.