CVE-2026-82220: CWE-294 Authentication Bypass by Capture-replay in WPMU DEV Forminator

This vulnerability (CVE-2026-82220) in Forminator versions up to 1.57.1 allows unauthenticated attackers to bypass authentication controls by replaying captured authentication data. It is categorized as CWE-294 (Authentication Bypass) and has a CVSS 3.1 score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts the integrity of the system but does not affect confidentiality or availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

The vulnerability enables an attacker without authentication to bypass authentication mechanisms, potentially allowing unauthorized actions that impact system integrity. Confidentiality and availability are not affected according to the CVSS vector. Since no exploits are known in the wild, the immediate risk may be limited but the medium severity score indicates a notable risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.