A severe security flaw in the popular Forminator WordPress plugin has been discovered that could allow attackers to completely take over websites without authentication. The vulnerability, designated CVE-2025-6463, carries a high-severity CVSS score of 8.8 and affects all versions of Forminator up to 1.44.2.

## What is Forminator?

Forminator is a widely-used WordPress plugin developed by WPMU DEV that provides a drag-and-drop form builder for creating various types of forms and content. With over 600,000 active installations according to WordPress.org statistics, it represents a significant portion of the WordPress ecosystem.

## The Vulnerability Explained

The security flaw stems from inadequate input validation and unsafe file deletion processes within the plugin’s code. Here’s how the attack works:

1. **Malicious Form Submission**: An attacker submits a specially crafted form containing fake file paths pointing to critical WordPress files, such as the wp-config.php file
2. **Insufficient Validation**: The plugin’s ‘save_entry_fields()’ function fails to properly validate whether fields should handle file uploads, accepting malicious file paths in any field type
3. **Dangerous Deletion**: When administrators delete form entries or the plugin automatically removes old submissions, it deletes the targeted critical files
4. **Site Takeover**: Deleting wp-config.php forces the WordPress site into setup mode, allowing attackers to connect it to their own database and gain complete control

## Discovery and Response

Security researcher ‘Phat RiO – BlueRock’ discovered the vulnerability and reported it to Wordfence on June 20, earning an $8,100 bug bounty. The timeline of the response was:

– **June 23**: Wordfence contacted WPMU DEV
– **June 30**: WPMU DEV released Forminator version 1.44.3 with security fixes

The patch includes proper field type validation and restricts file deletions to the WordPress uploads directory only.

## Current Status and Recommendations

While 200,000 downloads of the patched version have occurred since its release, many installations likely remain vulnerable. Currently, there are no reports of active exploitation, but the public disclosure of technical details increases the risk of attacks.

**Immediate Actions Required:**
– Update Forminator to version 1.44.3 or later immediately
– If immediate updating isn’t possible, deactivate the plugin until you can upgrade
– Monitor your website for any suspicious activity

The combination of the vulnerability’s ease of exploitation and the large number of affected websites makes this a critical security issue requiring immediate attention from WordPress administrators.