CVE-2026-5461: Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previousdraftid parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
Event History
Frequently Asked Questions
Which files can an attacker delete?
An unauthenticated attacker can delete arbitrary non-PHP files within the WordPress wp-content/uploads/ directory. The available information does not indicate that files outside that directory or PHP files can be deleted.
Does exploitation require an account or user interaction?
No. The vulnerability is reachable over the network and requires neither authentication nor user interaction.
What attack sequence is required?
The attacker must submit a draft with poisoned upload-field metadata through a POST request, then cause a subsequent draft submission to reference that poisoned draft using the previous_draft_id parameter. The deletion occurs when the later draft processes the attacker-controlled metadata.
How can I determine whether my site is affected?
Sites using the Forminator Forms WordPress plugin at version 1.55.0.2 or earlier are affected. Review the installed plugin version and investigate draft submissions and unexpected deletions of non-PHP files in wp-content/uploads/.