CVE-2026-57815— WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| WPMU DEV - Your All-in-One WordPress Platform | Forminator | ≤ 1.55.0.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57815
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Path Traversal.This issue affects Forminator: from n/a through <= 1.55.0.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| WPMU DEV - Your All-in-One WordPress Platform | Forminator | 0 ~ 1.55.0.2 | - |
II. Public POCs for CVE-2026-57815
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57815
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57815 (1)
IV. Related Vulnerabilities
Same product: Forminator
- CVE-2026-57814
WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripti - CVE-2026-56071
WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting - CVE-2026-32409
WordPress Forminator plugin <= 1.50.2 - Broken Access Contro - CVE-2024-45625
WordPress plugin Forminator Forms 安全漏洞 - CVE-2024-28890
WordPress plugin Forminator 安全漏洞
Same vendor: WPMU DEV - Your All-in-One WordPress Platform
- CVE-2026-57814
WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripti - CVE-2026-39466
WordPress Broken Link Checker plugin <= 2.4.7 - SQL Injectio - CVE-2026-32409
WordPress Forminator plugin <= 1.50.2 - Broken Access Contro - CVE-2026-24998
WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure - CVE-2025-22288
WordPress Smush Image Compression and Optimization plugin <=
Same weakness: CWE-22
- CVE-2026-57898
CVE-2026-57898 - CVE-2026-12482
Path Traversal via Symlink Name Validation Bypass in keras-t - CVE-2026-15626
nextlevelbuilder GoClaw ACP ToolBridge Workspace tool_bridge - CVE-2026-57856
Cockpit CMS Path Traversal via Bucket Name in Bucket File St - CVE-2026-49970
Laravel-Mediable < 7.0.0 Path Traversal via File::sanitizePa
V. Comments for CVE-2026-57815
No comments yet