CVE-2026-5461

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.55.0.3

Description Unauthenticated attackers can delete arbitrary non-PHP files within the wp-content/uploads/ directory. This occurs because the plugin accepts arbitrary upload field metadata from POST requests in draft submissions without proper validation. The issue is triggered when a subsequent draft references a poisoned draft using the previous draft id parameter.

Recommendations Update Forminator Forms to version 1.55.0.3 or later.