CVE-2025-6463: fallo de gravedad alta en wpmudev Forminator Forms – Contact Form…
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
26Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 15%
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVEs relacionadas — wpmudev Forminator Forms – Contact Form…
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-4596CRITICALForminator <= 1.24.6 - Unauthenticated Arbitrary File UploadEPSS 14.3%CVE-2026-15748CRITICALForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field ConfigurationEPSS 4.1%CVE-2023-6133MEDIUMForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.9%CVE-2026-5192HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'EPSS 0.8%CVE-2026-92229CRITICALForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' ParameterEPSS 0.7%CVE-2024-7389HIGHForminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information ExposureEPSS 0.7%