Forminator vulnerabilities

6 known vulnerabilities in Forminator from Incsub. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Forminator Forms – Contact Form, Payment Form…: Deserialization of Untrusted Data

  CVE-2025-6464Jul 2, 2025Wpmudev

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function.

• 8.8 High severity

  Forminator Forms – Contact Form, Payment Form…: External Control of File Name or Path

  CVE-2025-6463Jul 2, 2025WpmudevEPSS 15.1%

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.4

• 8.8 High severity

  Forminator Forms – Contact Form, Payment Form…: Missing Authorization

  CVE-2024-10402Oct 26, 2024Wpmudev

  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authentic

• 7.5 High severity

  Forminator Forms – Contact Form, Payment Form…: Insufficiently Protected Credentials

  CVE-2024-7389Aug 2, 2024Wpmudev

  The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integrat

• 7.2 High severity

  Forminator: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-31077Apr 23, 2024WPMU DEVEPSS 30.4%

  Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) con

• 9.8 Critical severity

  Forminator Forms – Contact Form, Payment Form…: Unrestricted Upload of File with Dangerous Type

  CVE-2023-4596Aug 30, 2023WpmudevEPSS 14.3%

  The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible