CVE-2026-65459

Summary

The Forminator plugin allows unauthenticated users to delete arbitrary content, including forms and submissions, without requiring any authentication or authorization. This vulnerability enables attackers to arbitrarily delete critical form data and potentially disrupt business operations.

Exploitability

Exploitation is straightforward as it requires no authentication and can be performed by any attacker with access to the vulnerable WordPress site, making it highly practical to exploit in the wild.

Blast radius

The impact could be significant as attackers could delete all form submissions, potentially affecting customer data collection, lead generation, and business workflows that rely on Forminator forms.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Forminator version 1.57.4 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.