EUVD-2026-113708
GHSA-r8hv-m5jv-xrcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend draft submission with poisoned upload metadata
-
ExploitSubmit second draft referencing previous_draft_id
-
ExecutionPlugin uses unvalidated path during draft cleanup
-
ImpactDelete arbitrary non-PHP file in wp-content/uploads/
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File name/path control
|
| Exploitation Conditions | Requires a published Forminator form that includes a file upload field and supports draft/save-and-continue submissions, since the attack abuses unvalidated upload field metadata in draft submissions combined with the previous_draft_id parameter. No authentication is required (PR:N) and no user interaction is needed (UI:N). Exploitation is bounded: only non-PHP files can be deleted, and only within the wp-content/uploads/ directory - PHP files and paths outside uploads are not affected, which limits the practical damage to removal of media/attachments rather than code tampering. |
| Impact | This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) makes it remotely reachable by unauthenticated attackers with low complexity and no user interaction, which raises its reachability profile; however, impact is constrained to I:L/A:L with C:N - it enables deletion of arbitrary non-PHP files inside wp-content/uploads/ only, not code execution or data disclosure. The vuln.today priority is 'this_month', not act_now/emergency, consistent with the limited impact. No EPSS score was supplied, no CISA KEV listing is present, and no confirmed public exploit code is indicated in the input - the Wordfence and plugins.trac links are an advisory plus source/patch references, not a working PoC. Signals are therefore broadly consistent: easy to reach but limited in damage. The 'Information Disclosure' tag conflicts with the actual mechanism and the C:N metric - this is a file-deletion (integrity/availability) flaw, not a confidentiality one; treat the tag as inaccurate. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a draft form entry to a Forminator form that has a file upload field, planting attacker-controlled upload field metadata that points at an arbitrary file path under wp-content/uploads/. They then submit a second draft that references the poisoned draft via the previous_draft_id parameter, causing the plugin to delete the referenced non-PHP file. No public exploit code is identified in the provided data at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Unauthenticated deletion of arbitrary non-PHP files inside wp-content/uploads/ affects every version of the Forminator Forms WordPress plugin up to and including 1.55.0.2. The plugin trusts upload field metadata supplied in POST requests for draft submissions, and when a later draft is linked to the poisoned one through the previous_draft_id parameter, that attacker-controlled metadata is used as the file path for a delete operation. No KEV entry, no EPSS signal and no public exploit code were identified at time of analysis; exploitation is limited to media and attachments rather than code execution, since PHP files and paths outside the uploads directory are out of scope, keeping this a moderate-priority issue slated for this-month handling rather than emergency response.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the vendor SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3593819%40forminator&new=3593819%40forminator touches the vulnerable code, but no tagged release number beyond the vulnerable 1.55.0.2 is given in the available data, so administrators should track the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/de1aaacf-8fe1-4a1e-9846-f78cc469ec20?source=cve) and the plugin's changelog to confirm the first fixed build before relying on an update. Until that version is confirmed, the exploitable surface is a published form that contains a file upload field and permits draft or save-and-continue submissions; removing the upload field from published forms, or disabling draft saving on forms that need uploads, eliminates the attack path at the cost of losing those form capabilities. Note that the restriction is narrow by design - only non-PHP files inside wp-content/uploads/ can be removed, so PHP files and paths outside the uploads directory are not exposed and no code-tampering workaround is required beyond the above.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-73 (External Control of File Name or Path): the plugin builds a filesystem path for deletion from data supplied by the client instead of validating it against server-side state. Forminator's custom-forms front controller (library/modules/custom-forms/front/front-action.php, around line 692) accepts upload field metadata from POST bodies during draft submissions without verifying that the metadata corresponds to an actual upload, and the entry model (library/model/class-form-entry-model.php, around lines 1387 and 2975) later consumes that stored metadata when a subsequent draft references the poisoned record via previous_draft_id, performing the deletion at that point. The referenced upstream changeset (3593819) in the WordPress plugin SVN indicates where the code was touched. Because the deletion primitive is constrained by the uploads-path assumption and by a non-PHP file filter, it yields a limited-integrity, limited-availability impact (C:N/I:L/A:L) rather than arbitrary file manipulation or code execution. Preconditions are a published form containing a file upload field that also supports draft / save-and-continue submissions; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attacker needs no credentials and no victim interaction once such a form exists.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated remote request with no user interaction (AV:N/AC:L/PR:N/UI:N); deletion of limited non-PHP files in uploads gives I:L/A:L and no data exposure gives C:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB