CVE-2026-89435: Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in validateurlisins3bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frmviewforms capability, without checking installplugins or activateplugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites running Formidable Forms version 6.35 or earlier are affected only when Formidable Pro is not installed. The issue is reachable by authenticated users with subscriber-level access or higher.
What does an attacker need to exploit it?
An attacker needs an authenticated WordPress account with a role that has the delegable frm_view_forms capability. They do not need install_plugins or activate_plugins capabilities because the affected permission check relies on a shared token instead.
What is the impact of successful exploitation?
A successful attacker can install arbitrary plugins on the WordPress server. This can lead to high-impact compromise of confidentiality, integrity, and availability depending on the installed plugin.