WPMU DEV Forminator: Privilege escalation via incorrect privilege assignment

Summary

Forminator, a WordPress form-builder plugin, contains an incorrect privilege assignment that allows privilege escalation. According to Patchstack, a low-privilege user can become an administrator and gain full control of the website. The vulnerability is remotely exploitable, but Patchstack notes many prerequisites, and CISA SSVC lists exploitation as none.

Affected

• Forminator up to and including 1.57.3
• VulDB also lists 1.57.0 to 1.57.3 as affected

Fixed in

• Forminator 1.58.0 (fix version reported by Patchstack and the CVE record: at least 1.58.0)
• The WordPress.org listing shows 1.58.3 as the newest release; the vendor's primary advisory was not reviewed

Workaround

• No vendor workaround known. Update the plugin.
• Until the update is applied, review administrator and recently created accounts and role assignments for unexpected changes.

Exploitation

• No public exploit known (VulDB).
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Patchstack does not expect mass exploitation.
• No in-the-wild exploitation found; the CISA KEV catalogue was not checked directly.

Our recommendation

• Update Forminator to the latest version from WordPress.org immediately, and at least to 1.58.0.
• Check all user accounts and administrator roles for unexpected entries, and remove any you do not recognise.
• Review which accounts can edit forms and which roles are assigned through Forminator.
• Monitor for new administrator accounts or changed roles.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• NVD record via Vulners vulners.com
• VulDB entry vuldb.com
• WordPress.org plugin page wordpress.org
• WPScan plugin page wpscan.com
• Patchstack vulnerability history for Forminator patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:41.