The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin fails to validate file paths in the entry_delete_upload_files function, allowing an unauthenticated attacker to specify any file when submitting a form. When the form entry is deleted—either by an administrator or automatically—the plugin deletes the file referenced by that path. If the attacker chooses a critical WordPress file such as wp-config.php or any plugin file, the loss of that file can be leveraged to execute arbitrary code on the site.

All WordPress sites running the Forminator plugin in versions up to and including 1.44.2 are affected. The vulnerability exists in the wpmudev:Forminator Forms – Contact Form, Payment Form & Custom Form Builder product and affects any WordPress environment where this plugin is installed.

The CVSS score of 8.8 indicates a high severity flaw. The EPSS score of less than 1% suggests a very low probability of exploitation at the time of this analysis, and the issue is not listed in CISA’s KEV catalog. Nevertheless, the flaw can be exploited by unauthenticated users via the public form submission endpoint, and the attack path requires only form submission, making the vulnerability straightforward to use if an attacker can target a site that allows form submissions. Once the form entry is deleted, the arbitrary file path provided will be interpreted and removed by the plugin, potentially enabling remote code execution.