Forminator Fiasco: 400,000 WordPress Sites at Risk Due to Vulnerability!
A flaw in the Forminator WordPress plugin allows attackers to delete crucial files and seize control of over 400,000 websites. This exploit involves an arbitrary file deletion vulnerability in Forminator, making it a prime target. Users should update to the latest version immediately to avoid potential chaos.
Hot Take:
When it comes to cybersecurity, Forminator just got schooled in the art of vulnerability! With more than 400,000 websites at risk, it’s time for WordPress users to update faster than you can say “CVE-2025-6463”. This is one form you definitely don’t want to fill out!
Key Points:
- Forminator, a popular WordPress plugin, has a critical vulnerability affecting over 400,000 websites.
- The vulnerability (CVE-2025-6463) allows attackers to delete arbitrary files due to insufficient file path validation.
- Exploitation could lead to site takeover, especially if attackers delete crucial files like wp-config.php.
- The flaw was patched in version 1.44.3, but many sites remain unprotected due to slow update adoption.
- A researcher was awarded an $8,100 bug bounty for discovering the vulnerability.
Already a member? Log in here