The Forminator Forms plugin for WordPress contains a critical PHP Object Injection vulnerability that could allow unauthenticated attackers to execute arbitrary code when combined with other vulnerable software.

This flaw involves deserialization of untrusted input within the entry_delete_upload_files function, allowing unauthenticated attackers to inject a PHP Object. While the vulnerability requires an additional plugin or theme containing a POP chain to be fully weaponized, it poses a severe risk of arbitrary file deletion, data theft, or remote code execution.

Successful exploitation could lead to a full site compromise, including the loss of sensitive customer data or unauthorized modification of the WordPress environment. Given the CVSS score of 7.5, this vulnerability represents a high-risk security gap that could lead to significant reputational damage and operational downtime if an attacker successfully identifies a compatible POP chain on the host system.

Immediate Action: Update the Forminator Forms plugin to the latest available version provided by WPMU DEV to incorporate the necessary deserialization security hardening.

Proactive Monitoring: Monitor server access logs and WordPress audit logs for suspicious file upload activity or unusual requests targeting the plugin's entry deletion endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious serialized object strings or malicious PHAR file uploads.

Public Exploit Available: No (exploit_available unknown).

Organizations utilizing the Forminator Forms plugin must prioritize updating to the most recent version provided by the vendor. Even though the vulnerability requires a secondary component to achieve full impact, the potential for remote code execution necessitates immediate patching to ensure the security of the WordPress installation and its underlying data.