CVE-2026-96335 in Forminator Plugin
Summary
by MITRE • 10/07/2026
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Forminator: from n/a through 1.57.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The identified security flaw resides within the WPMU DEV Forminator plugin, specifically affecting versions ranging from initial releases up to version 1.57.2. This vulnerability is classified as a missing authorization issue, which fundamentally represents an incorrect configuration of access control levels. In web application architecture, proper authorization ensures that users can only perform actions and access resources for which they have been explicitly granted permission. When this mechanism fails or is absent, the system relies on implicit trust rather than explicit verification, creating a critical gap in security posture. This type of flaw allows attackers to bypass intended restrictions by directly manipulating requests to endpoints or functions that should be protected behind authentication or role-based access controls.
From a technical perspective, the vulnerability stems from insufficient checks performed by the server-side logic when processing user inputs related to form submissions or administrative settings managed through Forminator. An attacker can exploit this weakness by crafting specific HTTP requests that target internal API endpoints or action hooks without providing valid session tokens or possessing the necessary administrator privileges. Because the application does not adequately verify whether the requesting entity has the requisite permissions, it processes these unauthorized actions as if they were legitimate. This behavior aligns with CWE-284, which describes Improper Access Control, and is often associated with CWE-862, Missing Authorization. The exploitation typically involves identifying endpoints that handle sensitive operations such as modifying form configurations, accessing submitted data, or altering plugin settings without requiring a valid authenticated session with appropriate roles.
The operational impact of this vulnerability is significant for any organization relying on Forminator to manage user interactions and collect data. Successful exploitation could lead to unauthorized modification of forms, potentially allowing attackers to inject malicious fields designed to harvest sensitive information from legitimate users. Furthermore, an attacker might be able to delete or alter existing form structures, causing denial of service conditions that disrupt business operations dependent on those specific workflows. In more severe scenarios, if the plugin interacts with other systems or databases in a way that allows for further privilege escalation, the scope of damage could expand beyond simple data manipulation to include complete compromise of the underlying web application environment. The ability to bypass access controls undermines the integrity and confidentiality guarantees provided by the platform, eroding trust among end-users whose personal information may be exposed through manipulated forms.
Mitigation strategies must focus on immediate remediation and long-term hardening practices. The primary recommendation is to upgrade Forminator to a version later than 1.57.2 where this authorization check has been corrected by the developers. Until an update can be applied, administrators should consider implementing web application firewall rules that restrict access to known vulnerable endpoints based on IP reputation or request patterns indicative of unauthorized access attempts. Additionally, enforcing strict role-based access control policies at the WordPress level and ensuring that only trusted users have administrative capabilities can reduce the attack surface. Regular security audits and penetration testing are essential to identify similar misconfigurations in other plugins or custom code within the environment. Adhering to industry standards such as OWASP Top 10, particularly regarding broken access control, will help maintain a robust defense-in-depth strategy against evolving threats targeting WordPress ecosystems.