Unauthenticated Content Deletion Vulnerability in Forminator Plugin by WPMU DEV
CVE-2026-65459

7.5HIGH

Key Information:

Vendor

WordPress
Status
Forminator
Vendor
CVE Published:
10 October 2026

What is CVE-2026-65459?

The Forminator plugin version 1.57.3 and earlier is susceptible to a security flaw that allows unauthenticated users to delete content arbitrarily. This vulnerability can be exploited by attackers to remove critical data, potentially leading to significant disruptions for website owners. It is crucial for administrators to update to the latest version to mitigate this risk and ensure the integrity of their web applications.

Affected Version(s)

Forminator <= 1.57.3

References

https://patchstack.com/database/wordpress/plugin/forminat...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.