The vulnerability in WPMU DEV’s Forminator plugin allows an attacker to spoof identities when interacting with payment forms. By forging request parameters or session data, an attacker can submit payments or access functionality intended for legitimate users. The flaw falls under CWE‑290 and enables attackers to bypass the plugin’s authentication controls, threatening the confidentiality, integrity, and availability of payment processing.

The issue impacts the Forminator plugin for WordPress, versions n/a through 1.57.2. Affected vendors include WPMU DEV, and any WordPress site that has the plugin installed and configured for payment collection. Sites running the patched 1.57.2.1 or later are not affected.

The flaw has a CVSS score of 7.5, indicating moderate to high severity, and the EPSS score is not available, so the exact likelihood of exploitation cannot be determined. It is not listed in the CISA KEV catalog. Attackers can exploit this via the plugin’s exposed form endpoints, sending crafted requests to spoof identities. Vulnerable sites that process payments through Forminator are thus at risk of unauthorized transactions and potential fraud. Mitigation is strongly recommended.