Live › vulnerability › CVE-2026-116859
Forminator, a WordPress form-builder plugin by WPMU DEV, has a missing authorization check that lets a user do things their role should not allow. The sources do not say which data or actions an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the Forminator WordPress plugin version 1.58.3 or earlier. The sources do not say which roles or configurations make the missing check reachable, so treat any site with the plugin as in scope until the version is confirmed.
No product ranges from the sources yet.
wp plugin get forminator --field=version1.58.31.58.3 (the sources do not name the exact fixed release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-116859")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.