Medium 6.5Published Oct 30, 2026

CVE-2026-5461Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

Updated under an hour ago (Oct 30, 2026, 3:40 AM ET)

Does this affect you?

It affects wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder Exploited in the last 30 days

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

CVSS: 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness (CWE): CWE-73
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Wordfence
NVD analysis: Received
Record last updated: Oct 30, 2026
First seen by InfoSec Signals: Oct 30, 2026

Affected products

Affected products

wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder wpmudev:forminator_forms_contact_form_payment_form_and_custom_form_builder (from the name)	through 1.55.0.2	CNA record

References

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/de1aaacf-8fe1-4a1e-9846-f78cc469ec20?source=cve
https://plugins.trac.wordpress.org/browser/forminator/trunk/library/model/class-form-entry-model.php#L1387
https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.0/library/model/class-form-entry-model.php#L1387
https://plugins.trac.wordpress.org/browser/forminator/trunk/library/modules/custom-forms/front/front-action.php#L692
https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.0/library/modules/custom-forms/front/front-action.php#L692
https://plugins.trac.wordpress.org/browser/forminator/trunk/library/model/class-form-entry-model.php#L2975
https://plugins.trac.wordpress.org/browser/forminator/tags/1.52.0/library/model/class-form-entry-model.php#L2975
https://plugins.trac.wordpress.org/changeset?reponame=&old=3593819%40forminator&new=3593819%40forminator

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.