CVE-2025-6463
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a la eliminación arbitraria de archivos debido a una validación insuficiente de la ruta de archivo en la función 'entry_delete_upload_files' en todas las versiones hasta la 1.44.2 incluida. Esto permite que atacantes no autenticados incluyan rutas de archivo arbitrarias en el envío de un formulario. El archivo se eliminará al eliminar el formulario, ya sea por un administrador o mediante la eliminación automática determinada por la configuración del complemento. Esto puede provocar fácilmente la ejecución remota de código al eliminar el archivo correcto (como wp-config.php).
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2025-06-20 CVE Reserved
- 2025-07-01 CVE Published
- 2025-07-02 CVE Updated
- 2025-07-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-73: External Control of File Name or Path
CAPEC
References (3)
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wpmudev Search vendor "Wpmudev" | Forminator Forms – Contact Form, Payment Form & Custom Form Builder Search vendor "Wpmudev" for product "Forminator Forms – Contact Form, Payment Form & Custom Form Builder" | <= 1.44.2 Search vendor "Wpmudev" for product "Forminator Forms – Contact Form, Payment Form & Custom Form Builder" and version " <= 1.44.2" | en |
Affected
|