The vulnerability is a classic Cross‑Site Request Forgery flaw (CWE‑352) in the WordPress Forminator plugin that permits an attacker to forge requests on behalf of a logged‑in user. Based on the description, an attacker could trigger unintended form submissions, alter form behavior, or perform administrative actions without directly executing code, potentially leading to data tampering or privacy breaches.

WordPress sites that use the WPMU DEV Forminator plugin, versions 1.57.3 and earlier, are affected. The plugin is listed under "Forminator" in the WordPress plugin repository, and any site that has installed or activated it is at risk.

With a CVSS score of 7.1, this vulnerability is considered high severity. The EPSS score is currently not available, and it is not listed in CISA KEV. The description does not explicitly state the authentication requirement, but it is inferred that exploitation requires an authenticated user on the site; an attacker would need to entice that user to a malicious page that submits a forged request using a valid authentication cookie. Once the victim's browser submits the forged request, the site processes it as if it came from a legitimate user, potentially allowing the attacker to execute privileged actions such as altering form settings, submitting spam, or harvesting sensitive data.