Live › vulnerability › CVE-2026-89435
The Formidable Forms WordPress plugin, up to and including version 6.35, fails to check plugin-install permissions on a file URL parameter. An authenticated subscriber on a free-only site can install arbitrary plugins, which gives them code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 07:29 UTC. All times on this page are UTC.
Sites running Formidable Forms up to and including 6.35 without Formidable Pro. Any logged-in account with subscriber access or higher can trigger it, so sites that allow open registration are most exposed. Sites running Formidable Pro, or the plugin at a later version, are not affected.
No product ranges from the sources yet.
wp plugin get formidable --field=version6.35 (the first fixed version is not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
This page as .md · .json · in your agent: get_signal("CVE-2026-89435")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.