WordPress Plugin flaw exposes over 600,000 websites to potential remote takeover
Take action: If you're using the Forminator WordPress plugin, immediately update to version 1.44.3 or later. Your WordPress site is exposed to the internet by design, so attackers will find it very quickly. Don't delay, updating a plugin in WordPress is quite easy. Then check your form submission logs for any suspicious entries that might indicate your site was already targeted.
Learn More
A security vulnerability has been discovered in the Forminator WordPress plugin, exposing more than 600,000 active installations to potential takeover.
The vulnerability is tracked as CVE-2025-6463 (CVSS score 8.8). It stems from insufficient file path validation in the plugin's entry_delete_upload_files() function within the Forminator_Form_Entry_Model class. This function is designed to clean up uploaded files when form submissions are deleted, either manually by administrators or automatically through plugin settings.
The flaw allows unauthenticated attackers to craft malicious form submissions containing arbitrary file paths in any form field, even those not intended for file uploads. When these submissions are subsequently deleted, the plugin attempts to remove the files specified in the malicious paths without validating whether these files should be deleted or restricting deletion to the appropriate upload directories.
Attackers are able to target critical WordPress files, particularly the wp-config.php file. Deleting it forces the WordPress installation into setup mode, effectively allowing attackers to connect the site to a database under their control and load up a completely malicious site on the legitimate domain URL.
Security researcher Phat RiO – BlueRock discovered this vulnerability and reported it responsibly through the Wordfence Bug Bounty Program, earning a record-breaking bounty of $8,100 - the highest award in the program's history.
The WPMU DEV team, developers of the Forminator plugin released a patched version 1.44.3 on June 30, 2025.
Website administrators should immediately update their Forminator plugin to version 1.44.3 or later and check submission logs for suspicious activity.
