{"id":"CVE-2026-5461","kind":"vulnerability","aliases":["CVE-2026-5461"],"related":[],"title":"WordPress Forminator plugin: unauthenticated attackers can delete uploaded non-PHP files","description":"The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.","summary":"The Forminator Forms plugin for WordPress accepts attacker-supplied upload metadata in draft form submissions and uses it to delete files. An unauthenticated attacker can delete arbitrary non-PHP files inside wp-content/uploads/.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","runtime","self-hosted","wordpress"],"not_affected_if":["forminator-updated","plugin-not-installed"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or in `wp-content/plugins/forminator/` header of `forminator.php`\n- Check whether any site uses Forminator forms that accept drafts (`previous_draft_id` handling)","fix":"- Forminator plugin: versions up to and including `1.55.0.2` are affected; the sources do not state a fixed version","status":"open","published_at":"2026-10-30T05:16:59+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","triaged_at":"2026-10-30T05:29:24+00:00","updated_at":"2026-10-30T05:29:24+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T05:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator plugin: versions up to and including `1.55.0.2` are affected; the sources do not state a fixed version","reach":"internet","title":"WordPress Forminator plugin: unauthenticated attackers can delete uploaded non-PHP files","impact":"medium","summary":"The Forminator Forms plugin for WordPress accepts attacker-supplied upload metadata in draft form submissions and uses it to delete files. An unauthenticated attacker can delete arbitrary non-PHP files inside wp-content/uploads/.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","forminator","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker deletes non-PHP uploaded files in wp-content/uploads","analyst_note":"Confirm the fixed Forminator version and whether draft submissions are enabled by default, using the NVD entry and the WordPress plugin changelog.","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or in `wp-content/plugins/forminator/` header of `forminator.php`\n- Check whether any site uses Forminator forms that accept drafts (`previous_draft_id` handling)","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","forminator-updated"],"who_is_affected":"Sites running the Forminator Forms WordPress plugin at version 1.55.0.2 or older. The exposure comes from the public form draft endpoint, so any site with Forminator forms reachable from the internet is in scope. Sites without the plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4199,"output_tokens":618,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-5461':15A,18A '/uploads':61B,142C '1.55.0.2':81C 'accept':31B,88C 'arbitrari':52B,89C,132C 'attack':5A,33B,49B,129C 'attacker-suppli':32B 'content':60B,141C 'cve':13A,16A 'delet':7A,45B,51B,73C,107C,131C 'directori':143C 'draft':38B,97C,112C,116C,120C 'due':84C 'field':91C 'file':12A,46B,56B,72C,108C,136C 'form':27B,39B,64C 'formin':2A,19B,26B,63C 'host':23B 'id':121C 'includ':80C 'insid':57B 'limit':71C 'make':124C 'metadata':36B,92C 'non':10A,54B,134C 'non-php':9A,53B,133C 'paramet':122C 'php':11A,55B,135C 'plugin':3A,28B,65C,87C 'poison':115C 'possibl':126C 'post':94C 'previous':119C 'proper':100C 'refer':113C 'request':95C 'runtim':20B 'self':22B 'self-host':21B 'submiss':40B,98C 'subsequ':111C 'suppli':34B 'unauthent':4A,48B,128C 'upload':8A,35B,90C 'use':42B,105C 'valid':101C 'version':76C 'via':117C 'vulner':69C 'within':137C 'without':99C 'wordpress':1A,24B,30B,67C 'wp':59B,140C 'wp-content':58B,139C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator Forms WordPress plugin at version 1.55.0.2 or older. The exposure comes from the public form draft endpoint, so any site with Forminator forms reachable from the internet is in scope. Sites without the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T05:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-5461","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5461","severity":null,"published_at":"2026-10-30T05:16:59+00:00","modified_at":"2026-10-30T05:16:59+00:00","first_seen_at":"2026-10-30T05:28:35+00:00","fetched_at":"2026-10-30T05:28:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}