Snow Monkey Forms

Snow Monkey Forms has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 2 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Path Traversal, behind 2 of the records (100%).

Every one of the 2 issues recorded for Snow Monkey Forms has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. Snow Monkey Forms is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Snow Monkey Forms vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-1056

Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal

Read the full analysis

Vulnerability Records

2 records


2026-01-27 00:00	Snow Monkey Forms <= 12.0.3 - Unauthenticated Arbitrary File Deletion via Path Traversal Snow Monkey Forms <= 12.0.3	`CVE-2026-1056`	9.8 Critical	Sarawut Poolkhet (MisterHelloz)	Yes
2023-05-08 00:00	Snow Monkey Forms <= 5.1.1 - Directory Traversal via 'view' REST endpiont Snow Monkey Forms <= 5.1.1	`CVE-2023-28413`	5.3 Medium	Monkey Wrench Inc.	Yes

Showing 1–2 of 2 reports

Latestv13.0.0

Snow Monkey Forms

Author

Takashi Kitajima

5.0(6)

100/100

Last Updated

2026-08-19 (24d ago)

Active Installs

30,000+

Downloads

471,977

Requires WP

7.1+

Requires PHP

7.4+

Tested up to

WP 7.1

Created

2020-04-07 (7y ago)

The Snow Monkey Forms is a mail form plugin for the block editor. GitHub: https://github.com/inc2734/snow-monkey-forms/ Form fields Text email Tel URL File Textarea Select Radio buttons Checkboxes Date Month

View on WordPress.org