CVE-2026-28111 HIGH

CVE-2026-28111: WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

Vendor Wpmu Dev
Product Forminator
Weakness CWE-266
Published August 6, 2026
Last update August 6, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Forminator versions up to 1.56.0 assign incorrect privilege levels to user roles, allowing authenticated users with low privileges to perform actions restricted to higher-privilege accounts. An attacker with a standard user account can read, modify, or delete sensitive form data and settings. Update to version 1.56.2 or later to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete form data and settings with a low-privilege user account.

Potential impact on your site

04Site Impact

Form submissions, settings, and data may be accessed or altered by unauthorized users with basic accounts.

Conditions required to exploit

05Prerequisites

Attacker must have a valid low-privilege user account on the site.

Key dates

06Disclosure timeline

August 6, 2026 CVE published
August 6, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-57386 WordPress aBlocks plugin < 2.9.1 - Privilege Escalation vulnerability CVE-2026-27983 WordPress LMS Elementor Pro plugin <= 1.0.4 - Privilege Escalation vulnerability CVE-2026-39579 WordPress B Blocks plugin <= 2.0.31 - Privilege Escalation vulnerability CVE-2025-69183 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability CVE-2026-39587 WordPress WP BASE Booking plugin <= 5.9.0 - Privilege Escalation vulnerability