Formidable Forms WordPress plugin: Arbitrary plugin installation via file_url parameter
Summary
The free version of the Formidable Forms WordPress plugin up to and including 6.35 allows authenticated users with subscriber-level access or higher to install arbitrary plugins on the server. The flaw lies in insufficient URL validation of the 'file_url' parameter and a permission check that relies only on a shared token obtainable through the frm_view_forms capability. Formidable Pro must not be installed for the attack to work. A successful attack can lead to a backdoor, data theft or website defacement.
Affected
- Formidable Forms (free version, without Formidable Pro) up to and including 6.35
- Formidable Pro installations are not affected according to the description
Fixed in
- Version 7.0 (according to Dr. Web; not yet confirmed against the Wordfence record or the vendor changelog)
Workaround
- No vendor-published workaround for 6.35 and earlier.
- Restrict subscriber and higher accounts and disable open registration where not needed.
Exploitation
- Not known to be exploited in the wild (OffSeq); not in CISA KEV.
- Public proof of concept: not confirmed; sources conflict.
- CISA SSVC: Exploitation none, automatable no.
Our recommendation
- Check the installed version on all sites, including staging, and update to 7.0 or later.
- Review accounts with subscriber or higher roles and disable public registration where not needed.
- Check for unknown plugins and unexpected admin users on sites that were exposed while vulnerable.
- Monitor for exploitation, as the CVSS score is 8.8.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- Trac changeset 6.35 to 7.0 plugins.trac.wordpress.org
- Trac changeset FrmAddonsController.php plugins.trac.wordpress.org
- FrmAddonsController.php at 6.35 plugins.trac.wordpress.org
- VulDB CVE-2026-89435 vuldb.com
- OffSeq threat radar radar.offseq.com
- TheHackerWire CVE-2026-89435 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:45.
Original description (NVD)
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
NVD references (8)
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L…
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L…
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L…
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAppController.php#L1167
- https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/helpers/FrmAppHelper.php#L4934
- https://plugins.trac.wordpress.org/changeset/3746820/formidable/trunk/classes/controllers/FrmAddonsController…
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3750372%40formidable%2Ftags%2F7.0&old=3688662%40fo…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/87661de6-e835-495e-9bd2-4d64b4718108?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.