{"id":58302,"date":"2025-07-08T02:57:21","date_gmt":"2025-07-08T02:57:21","guid":{"rendered":""},"modified":"2025-07-11T11:06:24","modified_gmt":"2025-07-11T17:06:24","slug":"cve-2025-6463-arbitrary-file-deletion-vulnerability-in-forminator-forms-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-6463-arbitrary-file-deletion-vulnerability-in-forminator-forms-wordpress-plugin\/","title":{"rendered":"CVE-2025-6463: Arbitrary File Deletion Vulnerability in Forminator Forms WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has recently identified a serious security vulnerability dubbed CVE-2025-6463. This flaw lies within the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress and affects all versions up to, and including, 1.44.2. This vulnerability poses a significant threat to WordPress websites running the Forminator Forms<\/a> plugin, as it allows unauthenticated attackers to trigger arbitrary file deletion, potentially leading to system compromise or data leakage.
\nGiven the severity of the potential impact, it is crucial that administrators and developers using this plugin understand the nature of this vulnerability<\/a>, its workings, and how to mitigate it effectively.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-6463
\nSeverity: High (8.8 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Arbitrary file deletion potentially leading to remote code execution and system<\/a> compromise<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Forminator Forms – Contact<\/a> Form, Payment Form & Custom Form Builder Plugin for WordPress | Up to and including 1.44.2<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability lies in the ‘entry_delete_upload_files’ function of the Forminator Forms<\/a> plugin. Due to insufficient file path validation, an unauthenticated attacker can include arbitrary file<\/a> paths in a form submission. When the form submission is deleted-either manually by an Administrator or automatically via the plugin’s settings-the file<\/a> specified in the arbitrary path will also be deleted.
\nThis exploit can lead to remote code execution if a critical<\/a> file-such as wp-config.php-is deleted. This file deletion can disrupt the normal operation of the WordPress site and potentially grant the attacker access to sensitive information<\/a>, leading to system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a hypothetical example of an HTTP request that could exploit this vulnerability<\/a>.<\/p>\n

POST \/forminator_forms\/submit_form HTTP\/1.1\nHost: victim-website.com\nContent-Type: multipart\/form-data\n{\n\"form_id\": \"123\",\n\"field_id\": \"file_upload_field\",\n\"file_path\": \"\/absolute\/path\/to\/wp-config.php\"\n}<\/code><\/pre>\n
In this example, the attacker uses the POST method to submit a form with an arbitrary file<\/a> path pointing to the wp-config.php file. When the form is deleted, the wp-config.php file will also be deleted, potentially leading to remote code execution<\/a>.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate this vulnerability, users are advised to apply the vendor-supplied patch immediately. In cases where this is not possible, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary measure to monitor and block malicious activity. In all cases, regular monitoring and updating of all WordPress plugins and core files is recommended to prevent future vulnerabilities<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has recently identified a serious security vulnerability dubbed CVE-2025-6463. This flaw lies within the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress and affects all versions up to, and including, 1.44.2. This vulnerability poses a significant threat to WordPress websites running […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-58302","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t