EUVD lists Forminator Forms WordPress plugin limited file deletion flaw (6.5 CVSS)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- wpmudev
- Product
- Forminator Forms
- First seen
Summary
An EUVD entry updated 2026-10-30 rates a limited file deletion flaw in the Forminator Forms WordPress plugin at 6.5 under CVSS v3.1. It says all versions up to and including 1.55.0.2 are affected because the plugin accepts arbitrary upload field metadata.
If you use wpmudev
Update Forminator Forms to a version later than 1.55.0.2
Check the uploads directory for unexpected file deletions
Restrict form upload functionality if no fixed version is installed
Update Forminator Forms to a version later than 1.57.3.1
Review form submissions and entries for unauthorized access
Restrict admin access to form data until patched
What the sources say 2
· Mastodon: “The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2.” Source
· Mastodon: “The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via th...” Source