CVE-2025-6463: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entrydeleteuploadfiles' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forminator Forms – Contact Form, Payment Form & Custom Form Builderto a version that resolves this vulnerability.Fixed in 1.44.2 - Compensating control
Mitigate by restricting access to the WordPress admin (e.g., management endpoints and any form submission endpoints) so only trusted administrators can submit form deletions; this reduces exposure to attackers triggering deletion behavior via administrator form submission.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6463?
CVE-2025-6463 is considered a high severity vulnerability due to its risk of arbitrary file deletion.
How do I fix CVE-2025-6463?
To fix CVE-2025-6463, update the Forminator Forms plugin to the latest version beyond 1.44.2.
Which versions of Forminator Forms are affected by CVE-2025-6463?
CVE-2025-6463 affects all versions of Forminator Forms up to and including version 1.44.2.
What type of vulnerability is CVE-2025-6463?
CVE-2025-6463 is a file deletion vulnerability due to insufficient file path validation.
What should I do if I cannot update the plugin for CVE-2025-6463?
If you cannot update the plugin, consider disabling the Forminator Forms plugin until you can apply the fix.