CVE-2026-108486: WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Forminatorto a version that resolves this vulnerability.Fixed in 1.58.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The listed vector indicates network-reachable exploitation with no privileges or user interaction required. This means an unauthenticated remote attacker may be able to target affected Forminator installations.
Which installations are affected?
Forminator versions through 1.58.0 are listed as affected. The provided information does not identify a fixed version or any configuration prerequisites.
What is the likely security impact?
The supplied severity vector indicates low confidentiality impact and no integrity or availability impact. The issue is described as broken access control caused by missing authorization or incorrectly configured access-control security levels.