This vulnerability, identified as CWE-266 (Incorrect Privilege Assignment), affects Forminator versions up to and including 1.56.0. It allows an attacker with contributor privileges to escalate their privileges, potentially gaining unauthorized access or control within the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low complexity and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation guidance, and no exploits have been reported in the wild.

Successful exploitation could allow a contributor-level user to escalate privileges, potentially leading to unauthorized administrative actions, data compromise, or disruption of service within the affected Forminator plugin environment. The high CVSS score reflects the severity of impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.