Forminator Forms accepts arbitrary upload field metadata from POST requests in draft submissions without validation. The plugin then uses this metadata to delete files when a later draft references the poisoned draft via the previous_draft_id parameter, allowing an attacker to delete arbitrary non‑PHP files in the wp‑content/uploads/ directory. This weakness corresponds to the Unix Path Traversal deficiency described by CWE‑73, and can lead to loss of content or configuration files that are critical for website operation.

The vulnerability affects the WordPress Forminator Forms plugin by WPMU DEV, specifically the Contact Form, Payment Form & Custom Form Builder components. All releases up to and including version 1.55.0.2 are impacted.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly confirmed exploitation yet. The attack vector is unauthenticated, as the malicious input can be submitted without user authentication. If exploited, an attacker can delete arbitrary non‑PHP files from the uploads directory, potentially causing data loss or site disruption, but the scope is limited to file deletion and does not grant code execution.