{"id":"CVE-2026-89435","kind":"vulnerability","aliases":["CVE-2026-89435"],"related":[],"title":"WordPress Formidable Forms plugin lets subscribers install arbitrary plugins","description":"The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).","summary":"The Formidable Forms WordPress plugin, up to and including version 6.35, fails to check plugin-install permissions on a file URL parameter. An authenticated subscriber on a free-only site can install arbitrary plugins, which gives them code execution on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["formidable-forms","package","self-hosted","wordpress"],"not_affected_if":["formidable-pro-installed","no-user-registration","patched-version"],"how_to_check":"- Check the installed Formidable Forms version in the WordPress admin plugin list or with `wp plugin get formidable --field=version`\n- Check whether Formidable Pro is installed; the flaw only applies when it is not\n- Check the site's user list for subscriber-level accounts that could be created or abused","fix":"- Formidable Forms: move to a version later than `6.35` (the first fixed version is not stated in the sources)","status":"open","published_at":"2026-10-30T07:16:34+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","triaged_at":"2026-10-30T07:30:04+00:00","updated_at":"2026-10-30T07:30:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T07:30:04Z","model":"claude-haiku-5-5","output":{"fix":"- Formidable Forms: move to a version later than `6.35` (the first fixed version is not stated in the sources)","reach":"internet","title":"WordPress Formidable Forms plugin lets subscribers install arbitrary plugins","impact":"high","summary":"The Formidable Forms WordPress plugin, up to and including version 6.35, fails to check plugin-install permissions on a file URL parameter. An authenticated subscriber on a free-only site can install arbitrary plugins, which gives them code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","formidable-forms","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker installs a plugin and runs code on the server","analyst_note":"Confirm the first fixed version of Formidable Forms beyond 6.35 and the vendor advisory from the NVD entry.","how_to_check":"- Check the installed Formidable Forms version in the WordPress admin plugin list or with `wp plugin get formidable --field=version`\n- Check whether Formidable Pro is installed; the flaw only applies when it is not\n- Check the site's user list for subscriber-level accounts that could be created or abused","plain_action":"","needs_analyst":true,"not_affected_if":["formidable-pro-installed","patched-version","no-user-registration"],"who_is_affected":"Sites running Formidable Forms up to and including 6.35 without Formidable Pro. Any logged-in account with subscriber access or higher can trigger it, so sites that allow open registration are most exposed. Sites running Formidable Pro, or the plugin at a later version, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4293,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-89435':12A,15A '6.35':34B,96C 'access':159C 'activ':145C 'addit':170C 'arbitrari':8A,58B,86C,164C 'attack':154C 'authent':48B,153C 'bucket':117C 'builder':73C 'calcul':77C 'callback':121C 'capabl':139C,147C 'check':37B,141C 'code':63B 'contact':75C 'cve':10A,13A 'deleg':135C 'due':105C 'execut':64B 'exploit':169C 'fail':35B 'file':44B,99C 'form':3A,18B,26B,70C,72C,76C,138C 'formid':2A,17B,25B,69C,179C 'formidable-form':16B 'free':53B,177C 'free-on':52B,176C 'frm':136C 'give':61B 'host':22B 'includ':32B,95C 'instal':7A,40B,57B,88C,142C,163C,183C 'insuffici':107C 'let':5A 'level':158C 'make':149C 'obtain':129C 'packag':19B 'paramet':46B,101C,102C 'permiss':41B,120C 'plugin':4A,9A,28B,39B,59B,80C,87C,143C,146C,165C 'plugin-instal':38B 'possibl':151C 'prefix':109C 'pro':180C 'quizz':78C 'reli':123C 'requir':171C 's3':116C 'self':21B 'self-host':20B 'server':67B,168C 'share':127C 'site':55B,174C 'sole':124C 'subscrib':6A,49B,157C 'subscriber-level':156C 'token':128C 'url':45B,100C,108C,113C 'user':132C 'valid':110C,112C 'version':33B,91C 'via':97C 'view':137C 'vulner':84C 'without':140C 'wordpress':1A,23B,27B,71C,82C","nicknames":[],"mitigations":[],"who_affected":"Sites running Formidable Forms up to and including 6.35 without Formidable Pro. Any logged-in account with subscriber access or higher can trigger it, so sites that allow open registration are most exposed. Sites running Formidable Pro, or the plugin at a later version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89435","severity":null,"published_at":"2026-10-30T07:16:34+00:00","modified_at":"2026-10-30T07:16:34+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","fetched_at":"2026-10-30T07:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}