The Forminator plugin for WordPress allows an unauthenticated attacker to inject a PHP object through a PHAR file during form submission deletion. Deserialization occurs in the 'entry_delete_upload_files' function when an administrator deletes a form entry or when automatic cleanup removes entries. Because the plugin does not contain a known PHP Object Poisoning (POP) chain, the injected object alone does not result in code execution. However, if the site also hosts another plugin or theme that implements a POP chain, the attacker could use the injected object to delete files, retrieve data, or execute code. No public exploit chain exists within Forminator itself, so the vulnerability has no implicit impact unless a compatible POP chain is present.

The affected product is Forminator Forms – Contact Form, Payment Form & Custom Form Builder by wpmudev, a free WordPress plugin. All releases up to and including version 1.44.2 are vulnerable.

The CVSS v3.1 base score is 7.5, indicating a high severity. The EPSS score of 1% shows a low but non‑zero prediction of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires uploading a malicious PHAR file and triggering the deletion flow, which does not require authentication. Because only sites that also run a plugin or theme with an active POP chain can realize an impact, the practical risk is tied to the site’s plugin ecosystem. Sites that rely on the built‑in entry deletion feature and have no additional vulnerable code contain a lower risk profile but should still patch promptly to eliminate the injection vector.