Live › vulnerability › CVE-2026-5461
The Forminator Forms plugin for WordPress accepts attacker-supplied upload metadata in draft form submissions and uses it to delete files. An unauthenticated attacker can delete arbitrary non-PHP files inside wp-content/uploads/.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 05:28 UTC. All times on this page are UTC.
Sites running the Forminator Forms WordPress plugin at version 1.55.0.2 or older. The exposure comes from the public form draft endpoint, so any site with Forminator forms reachable from the internet is in scope. Sites without the plugin installed are not affected.
No product ranges from the sources yet.
wp-content/plugins/forminator/ header of forminator.phpprevious_draft_id handling)1.55.0.2 are affected; the sources do not state a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-5461")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.