Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter
Impact
Formidable Forms WordPress plugin versions up to 6.35 are vulnerable to arbitrary plugin installation via the 'file_url' parameter. This affects sites with subscriber-level access and above, without Formidable Pro installed. Insufficient URL prefix validation and inadequate permission checks are the weaknesses.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
strategy11team · Wordfence
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
1 range
strategy11team · Wordfence
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → through 6.35
semver versions
Other versions: unaffected
Original source description
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-89435View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-89435
Observed 2026-10-30T19:13:10.371Z · upstream updated 2026-10-30T18:09:00.504Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T17:32:42.670504Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.