Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
Strategic Overview
- Status
- Patched in 7.0
- Affected Plugin
- Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- Affected Version
<= 6.35- CVSS
- 8.8High
- Weakness type
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component
- CVE
CVE-2026-89435
At a glance
CVE-2026-89435 is a high-severity Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerability in the Formidable Forms WordPress plugin, affecting versions <= 6.35. It carries a CVSS score of 8.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires an authenticated account at Subscriber level or above. The issue is fixed in version 7.0; sites on affected versions should update now. Disclosed October 2026, reported by Supakiad S. (m3ez).
Vulnerability Overview
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Remediation
Update to version 7.0, or a newer patched version
How does WordSec protect against this?
An attacker needs Subscriber access first, so the firewall sees the attempt as traffic from a logged-in account: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Formidable Forms 7.0 closes this, and updating the plugin is the step that ends it.
- Firewall
- Alerts
External References
Related records
Other vulnerabilities in Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- 9.8CVE-2023-1405: Formidable Forms <= 6.1.2 PHP Object Injection
CVE-2023-1405 - 9.8CVE-2019-15780: Formidable Form Builder <= 4.02 PHP Object Injection
CVE-2019-15780 - 9.6CVE-2021-24884: Formidable Form Builder <= 4.09.04 Stored XSS
CVE-2021-24884 - 9.1Formidable Form Builder <= 2.0.21 Missing Authorization Checks
- 8.8CVE-2014-9309: Formidable Form Builder <= 1.07.11 SQL Injection
CVE-2014-9309 - 8.6Formidable Form Builder < 2.05.03 SQL Injection
- 8.3CVE-2017-20192: Formidable Form Builder < 2.05.03 Stored XSS
CVE-2017-20192 - 7.5CVE-2026-85642: Formidable Forms DoS
CVE-2026-85642
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C