CVE-2026-106611: Cross-Site Request Forgery (CSRF) in WPMU DEV Forminator

The vulnerability identified as CVE-2026-106611 is a CSRF issue in the WPMU DEV Forminator plugin. It affects all versions from the initial release up to and including 1.57.3. The CVSS 3.1 vector indicates that the attack can be performed remotely without privileges but requires user interaction. The impact includes low confidentiality loss, high integrity impact, and no availability impact. No known exploits are reported in the wild. No patch or remediation details are provided in the input data.

An attacker can trick an authenticated user into submitting unauthorized requests, potentially leading to unauthorized changes or actions within the Forminator plugin. The integrity of the affected system can be compromised, but confidentiality impact is limited and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users. Monitor vendor communications for official fixes.