{"id":"CVE-2026-116859","kind":"vulnerability","aliases":["CVE-2026-116859"],"related":[],"title":"WordPress Forminator plugin: missing authorization check exposes form data","description":"Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, has a missing authorization check that lets a user do things their role should not allow. The sources do not say which data or actions an attacker can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`\n- Compare the result against the affected range, which the sources give as through `1.58.3`","fix":"- Forminator: move to a version later than `1.58.3` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-03T17:17:57+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:29+00:00","updated_at":"2026-11-03T17:24:29+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:29Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator: move to a version later than `1.58.3` (the sources do not name the exact fixed release)","reach":"internet","title":"WordPress Forminator plugin: missing authorization check exposes form data","impact":"medium","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, has a missing authorization check that lets a user do things their role should not allow. The sources do not say which data or actions an attacker can reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","forminator","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to form data or plugin actions","analyst_note":"Check the NVD entry and the WPMU DEV changelog for the fixed version and the exact unauthorized action.","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`\n- Compare the result against the affected range, which the sources give as through `1.58.3`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Forminator WordPress plugin version 1.58.3 or earlier. The sources do not say which roles or configurations make the missing check reachable, so treat any site with the plugin as in scope until the version is confirmed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4107,"output_tokens":527,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116859':12A,15A '-2026':11A,14A '1.58.3':83C 'access':73C 'action':56B 'affect':78C 'allow':47B,69C 'attack':58B 'author':5A,35B,62C 'builder':27B 'check':6A,36B 'configur':72C 'control':74C 'cve':10A,13A 'data':9A,54B 'dev':31B,66C 'exploit':70C 'expos':7A 'form':8A,26B 'form-build':25B 'formin':2A,16B,22B,67C,68C,79C 'host':20B 'incorrect':71C 'issu':77C 'let':38B 'levels.this':76C 'miss':4A,34B,61C 'n/a':81C 'packag':17B 'plugin':3A,28B 'reach':60B 'role':44B 'say':52B 'secur':75C 'self':19B 'self-host':18B 'sourc':49B 'thing':42B 'user':40B 'vulner':63C 'wordpress':1A,21B,24B 'wpmu':30B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator WordPress plugin version 1.58.3 or earlier. The sources do not say which roles or configurations make the missing check reachable, so treat any site with the plugin as in scope until the version is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forminator","medium","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T17:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116859","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116859","severity":null,"published_at":"2026-11-03T17:17:57+00:00","modified_at":"2026-11-03T17:17:58+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}