CVE-2026-5461
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. The plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter, allowing unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
Risk Assessment
An unauthenticated attacker can delete files in the uploads directory, potentially causing data loss, site disruption, or facilitating further attacks. This affects the integrity and availability of site resources.
Recommendation
Update the Forminator Forms plugin to a version later than 1.55.0.2. Until then, consider restricting access to draft functionality or monitoring for unusual POST requests.
Other vulnerabilities in Forminator Forms WordPress plugin
See all- CVE-2026-97638High
The Forminator Forms plugin for WordPress in versions up to and including 1.57.3.1 is vulnerable to Insecure Direct Object Reference via the 'previous_draft_id' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions.
- CVE-2026-87074Low
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request. This allows unauthenticated visitors to make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the plugin itself and can be replayed without limit.
- CVE-2026-87068Medium
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz. This allows a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
- CVE-2026-87067High
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code.
Original NVD description (English source)
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS