CVE-2026-66583

CriticalCVSS 9.8

Published: 20/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Summary

Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.

Risk of taking over the WordPress site and executing malicious code without authentication.

Update the Forminator plugin to the latest available version that includes the security fix.

Original NVD description (English source)

Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.