CVE-2026-106611 in Forminator Plugin
Summary
by MITRE • 10/08/2026
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The identified security flaw represents a classic Cross-Site Request Forgery (CSRF) vulnerability within the WPMU DEV Forminator plugin, specifically impacting versions ranging from initial releases up to version 1.57.3. CSRF attacks exploit the trust that a web application has in a user's browser by tricking the victim into submitting a malicious request they did not intend to make. In this context, an attacker can craft a URL or HTML form containing actions such as creating new forms, modifying existing settings, or deleting data within the WordPress environment controlled by Forminator. Because many WordPress plugins handle state-changing operations via HTTP POST requests without adequate verification of the originator's intent, an authenticated user who visits a malicious site could inadvertently trigger these changes while their session with the target WordPress installation remains active and valid.
From a technical perspective, the root cause lies in the absence or insufficiency of anti-CSRF tokens within the form submission handling mechanisms of the affected plugin versions. Standard web application security practices dictate that any action resulting in a state change must require proof that the request originated from an authorized source. This is typically achieved through synchronizer token patterns where a unique, unpredictable value is embedded in forms and validated on the server side upon submission. The vulnerability indicates that Forminator failed to implement or enforce this validation for certain administrative or user-facing actions, allowing external sites to forge requests that appear legitimate to the backend processing logic of WordPress and the plugin itself. This aligns with CWE-352, which defines Cross-Site Request Forgery as a weakness where an application uses a user's credentials to perform unwanted commands without their consent.
The operational impact of this vulnerability is significant for site administrators and users who rely on Forminator for data collection or interactive features. An attacker could potentially create new forms that redirect submissions to malicious servers, thereby harvesting sensitive information submitted by legitimate visitors. Alternatively, the attacker might delete existing forms, causing service disruption and loss of collected data. In more severe scenarios involving administrative capabilities, an attacker with lower-level privileges could escalate their influence by modifying plugin configurations or user roles if such actions are exposed through vulnerable endpoints. This undermines the integrity and confidentiality guarantees provided by the application, leading to potential data breaches and reputational damage for the website owner.
This vulnerability maps directly to MITRE ATT&CK technique T1566.002, which covers Phishing: Spearphishing Link. Attackers often distribute malicious links via email or social engineering campaigns that lead victims to compromised websites hosting CSRF payloads. When a victim clicks the link while logged into their WordPress dashboard, the browser automatically includes session cookies with the forged request, allowing the attack to succeed without further authentication steps from the user. The lack of proper origin validation means the server cannot distinguish between requests initiated by the user and those crafted by an attacker, facilitating unauthorized state changes under the guise of normal application usage.
To mitigate this risk, immediate action is required for all systems running Forminator versions prior to 1.57.4. Site administrators should update the plugin to the latest patched version where these CSRF protections have been implemented. In addition to updating software, it is advisable to review server-side configurations such as enabling SameSite cookie attributes and ensuring that Content Security Policy headers are configured to restrict unauthorized form submissions. Regular security audits and penetration testing can help identify similar weaknesses in other plugins or custom code within the WordPress ecosystem. Maintaining strict access controls and monitoring for unusual activity patterns further reduces the attack surface, ensuring that even if a CSRF attempt is launched, its impact remains contained and detectable.