An unauthenticated path traversal vulnerability in the Forminator Forms plugin for WordPress allows attackers to read arbitrary files on the server.

This is a path traversal flaw categorized under CWE-22, triggered via the upload-1 file_path parameter in forms with specific file upload configurations, allowing unauthenticated remote attackers to read sensitive server files.

A successful exploit exposes sensitive server files, potentially leading to the leakage of configuration data, credentials, or other confidential information. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to data confidentiality and organizational security.

Immediate Action: Update the Forminator Forms plugin to a version newer than 1.52.1 as soon as a patch is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous file requests and review file upload configurations on public forms.

Compensating Controls: Implement a Web Application Firewall rule to block path traversal attempts containing directory traversal sequences in form parameters.

Public Exploit Available: false

This high severity vulnerability requires close attention due to the unauthenticated attack vector and potential for sensitive data exposure. Administrators should review their WordPress plugin configurations and apply the necessary updates immediately upon availability to mitigate the risk of unauthorized file access.