{"id":"CVE-2026-96336","published":"2026-10-09T10:16:44.730","lastModified":"2026-10-11T13:17:29.803","description":"Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-57-2-payment-bypass-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Forminator plugin has an authentication bypass vulnerability that allows attackers to spoof user identities during form submissions, potentially enabling unauthorized access to protected features or data without proper authentication.","exploitability":"This is a high-severity issue with low exploit complexity requiring no user interaction, but it likely requires the attacker to have access to the target WordPress site and be able to submit forms through the Forminator plugin.","blast_radius":"If exploited, this vulnerability could allow attackers to bypass authentication for form submissions, potentially leading to unauthorized data processing or access to restricted features within the Forminator plugin.","remediation":"Upgrade to version 1.57.3 or later","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","form","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:02:59.973Z"}}