What the vulnerability does
01Description
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
02Summary
Forminator Forms versions up to 1.44.2 contain a vulnerability that allows attackers to upload and execute arbitrary files on the site. An attacker can craft a malicious request that bypasses file type validation, enabling them to upload PHP code or other executable files. The vulnerability requires user interaction—typically a victim visiting a crafted link or page—but once exploited, grants full control over the site.
What an attacker can do
03Attacker Capabilities
Upload and run malicious code on the site, steal data, modify content, or take over the WordPress installation.
Potential impact on your site
04Site Impact
Complete compromise of the WordPress site, including data theft, malware injection, and loss of admin control.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or visit an attacker-controlled page; no login required.
Key dates
06Disclosure timeline
July 2, 2025
CVE published
April 8, 2026
Record updated
