Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This… (CVE-2026-108486)

CVE-2026-108486 describes a missing authorization vulnerability in the WPMU DEV Forminator plugin for WordPress, affecting versions up to 1.58.0. The issue arises from incorrectly configured access control security levels, allowing an attacker to bypass authorization checks. The vulnerability has a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating it can be exploited remotely without privileges or user interaction, resulting in limited confidentiality impact. No known exploits or patches are currently documented.

An attacker can remotely exploit this vulnerability without authentication or user interaction to gain unauthorized access to certain data or functionality, leading to limited confidentiality loss. There is no reported impact on integrity or availability. No active exploitation in the wild is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor WPMU DEV communications for updates. Until a fix is available, consider restricting access to the Forminator plugin features or limiting exposure of affected endpoints as a precaution.