The CVSS 7.2 rating for CVE-2026-19221 fundamentally misrepresents the actual blast radius. It measures site-level impact when the vulnerability grants network-wide compromise—a single site administrator on a WordPress multisite installation can execute arbitrary code across every site in the network. That's not a 7.2 authorization flaw; that's a network-level pivot point that rewrites the threat model for any multisite deployment using the affected plugin.
The technical mechanism is straightforward: Forminator failed to enforce the manage_network_options capability check that WordPress reserves for network super administrators. Network-wide settings were gated only by local site admin status, which erases the architectural boundary between site and network in multisite. Compromising one site's admin credentials—which can happen through any standard attack vector—now grants code execution across the entire network. This isn't hypothetical: the same failure pattern has appeared in at least two prior WordPress plugin CVEs (CVE-2021-24190, CVE-2020-25204), demonstrating this is a structural remediation failure, not an isolated coding mistake.
What makes this particularly dangerous is the blast radius topology. The attacker doesn't need to compromise N sites individually—they compromise the network's trust anchor once, and every subsequent site becomes trivially exploitable because the network configuration layer now executes under attacker control. The EPSS score of 0.00181 reflects current tooling absence, not absence of risk; this is precisely the vulnerability class that scales rapidly once exploit primitives circulate.
For practitioners: audit your WordPress multisite deployments for Forminator and verify whether network-wide settings exist. If they do, confirm that any plugin exposing network toggles explicitly checks manage_network_options, not merely local admin status. The CVSS vector deserves re-evaluation with network scope as the impact basis—this would materially shift severity and force prioritization conversations that site-level scoring obscures. The deeper problem is that each patch cycle normalizes the capability-gate fix without addressing why the boundary check gets lost in implementation in the first place, leaving the systemic debt intact for the next plugin to repeat.