{"id":"CVE-2026-65459","published":"2026-10-10T20:16:45.117","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-3-arbitrary-content-deletion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Forminator plugin allows unauthenticated users to delete arbitrary content, including forms and submissions, without requiring any authentication or authorization. This vulnerability enables attackers to arbitrarily delete critical form data and potentially disrupt business operations.","exploitability":"Exploitation is straightforward as it requires no authentication and can be performed by any attacker with access to the vulnerable WordPress site, making it highly practical to exploit in the wild.","blast_radius":"The impact could be significant as attackers could delete all form submissions, potentially affecting customer data collection, lead generation, and business workflows that rely on Forminator forms.","remediation":"Upgrade to Forminator version 1.57.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","form","data-loss"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:56.201Z"}}