CVE-2026-106611: WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Forminator pluginto a version that resolves this vulnerability.Fixed in 1.58.0
Event History
Frequently Asked Questions
Which Forminator versions are affected?
The issue affects Forminator versions through 1.57.3. The available data does not identify the first fixed version.
What must an attacker do to exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity, no attacker privileges required, and user interaction required. This is consistent with an attacker needing to induce a user to perform an unintended request.
What is the potential impact of successful exploitation?
The provided severity vector rates confidentiality impact as low and integrity impact as high, with no availability impact. The specific actions that could be performed through the forged request are not provided.