The vulnerability is described as a Missing Authorization issue in the WPMU DEV Forminator plugin. It allows attackers to exploit incorrectly configured access control security levels. As a result, unauthorized users can perform actions such as creating, editing, or deleting forms and accessing sensitive form data. This breaks confidentiality and integrity of site information and introduces potential for privilege escalation within the WordPress installation.

All WordPress sites running the Forminator plugin version 1.50.2 or earlier are impacted. The affected product is WPMU DEV – Your All‑in‑One WordPress Platform: Forminator, which includes all legacy releases up to and including 1.50.2.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is Remote over the Web via crafted HTTP requests to the plugin’s administrative interfaces. Exploitation does not require local access and can lead to unauthorized data exposure or configuration changes if successful.