The vulnerability is a missing authorization flaw in the WPMU DEV Forminator plugin that permits attackers to exploit incorrectly configured access control security levels. As a result, an attacker can bypass intended restrictions and potentially read, modify, or delete privileged form data or perform other high‑privilege actions. The weakness is categorized as CWE‑862, a lack of authorization checks.

The issue affects the Forminator WordPress plugin from its initial release through version 1.58.0. Any WordPress site that installs or has installed a version of Forminator up to and including 1.58.0 is potentially impacted regardless of WordPress core version.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw lies in plugin access control, an attacker likely needs to target a WordPress site running the vulnerable plugin, and can exploit the issue remotely through web requests. The lack of authorization checks means that the vulnerability can be leveraged even by users with restricted permissions, but it is not a generic remote code execution flaw.