---
id: "CVE-2026-5461"
kind: "vulnerability"
aliases: ["CVE-2026-5461"]
title: "WordPress Forminator plugin: unauthenticated attackers can delete uploaded non-PHP files"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["forminator", "runtime", "self-hosted", "wordpress"]
not_affected_if: ["forminator-updated", "plugin-not-installed"]
published_at: "2026-10-30T05:16:59+00:00"
first_seen_at: "2026-10-30T05:28:35+00:00"
updated_at: "2026-10-30T05:29:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5461", "first_seen_at": "2026-10-30T05:28:35+00:00"}]
---

# WordPress Forminator plugin: unauthenticated attackers can delete uploaded non-PHP files

The Forminator Forms plugin for WordPress accepts attacker-supplied upload metadata in draft form submissions and uses it to delete files. An unauthenticated attacker can delete arbitrary non-PHP files inside wp-content/uploads/.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Forminator version in the WordPress admin plugin list or in `wp-content/plugins/forminator/` header of `forminator.php`
- Check whether any site uses Forminator forms that accept drafts (`previous_draft_id` handling)

## Fix

- Forminator plugin: versions up to and including `1.55.0.2` are affected; the sources do not state a fixed version

## Timeline

- 2026-10-30T05:28:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-5461

## From the sources

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_