The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from an arbitrary file deletion vulnerability (CWE-73) due to insufficient validation of file paths in the 'entry_delete_upload_files' function. Unauthenticated attackers can submit crafted form data including arbitrary file paths, which are deleted when the corresponding form submission is removed by an administrator or automatically by the plugin. This can lead to deletion of critical files such as wp-config.php, potentially enabling remote code execution. The vulnerability affects all versions up to and including 1.44.2. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official fix has been confirmed yet.

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the server hosting the WordPress site. This can compromise site integrity and availability, and may lead to remote code execution if critical files like wp-config.php are deleted. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting use of the Forminator Forms plugin, especially the deletion of form submissions, to prevent exploitation. Monitoring plugin updates from wpmudev is recommended to apply any forthcoming patches promptly.