Cross-site request forgery (CSRF) affecting Forminator
A vulnerability affecting Forminator would allow an unauthenticated attacker to perform cross-site request forgery (CSRF), potentially compromising the integrity of data on affected systems.
Description
Technical context and vulnerability details
Forminator is a form and quiz builder plugin for WordPress. This product is affected by a vulnerability labeled CVE-2026-106611 resulting from insufficient validation of cross-site requests. Exploitation of this vulnerability could allow an unauthenticated attacker to submit spoofed requests on behalf of an authenticated user, resulting in unauthorized changes to configurations or data. It is classified high with a severity score of 7.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- System and data integrity breach;
Affected systems
Products, components and targeted versions
- All versions of Forminator prior to version 1.57.3 inclusive;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Forminator to version 1.58.0 or the latest stable version available;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.