The vulnerability identified as CVE-2026-57815 involves improper limitation of a pathname to a restricted directory in the Forminator WordPress plugin by WPMU DEV. This path traversal flaw allows an unauthenticated attacker to potentially read arbitrary files on the server by manipulating file path inputs. The affected versions include all versions up to and including 1.55.0.2. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server that should be restricted, potentially leading to disclosure of confidential information. The integrity and availability of the system are not impacted according to the CVSS vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.