CVE-2026-116859: WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

Q: Which installations are affected?

Forminator versions through 1.58.3 are affected. The available data does not identify a fixed version.

Q: Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected impact?

The stated impact is integrity-only and low: the CVSS vector indicates no confidentiality or availability impact, but a low integrity impact.

Published Nov 3, 2026

Updated

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.

Event History

Nov 3, 2026

CVE Published

via MITRE·04:48 PM

Data Sourced

via MITRE·04:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Forminator versions through 1.58.3 are affected. The available data does not identify a fixed version.

Can this be exploited remotely without an account?

Yes. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected impact?

The stated impact is integrity-only and low: the CVSS vector indicates no confidentiality or availability impact, but a low integrity impact.

CVE-2026-116859: WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

Event History

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Can this be exploited remotely without an account?

What is the expected impact?