Forminator Flaw Exposes WordPress Sites to Takeover Attacks: Vulnerability Threatens 600,000+ Sites

Daily Security Review

A critical new WordPress vulnerability—CVE-2025-6463—has been discovered in the widely used Forminator plugin, affecting over 600,000 active installations and putting hundreds of thousands of websites at risk of full compromise. In this episode, we dive deep into the mechanics, risks, and remediation of this arbitrary file deletion flaw and explain what every WordPress administrator, developer, and security professional needs to know.

At the heart of this issue is improper validation in how the Forminator plugin handles file paths when deleting form entries. This allows unauthenticated attackers to inject file paths into form submissions—even in fields not meant to accept files—and trick the system into deleting critical WordPress files like wp-config.php. The result? A full site reset, granting attackers an opportunity to seize control of the site.

Here’s what we unpack in this episode:

• The CVE-2025-6463 Vulnerability: How the exploit works, which function is flawed (entry_delete_upload_files), and why unsanitized file arrays in form fields make this so dangerous.
• Real-World Impact: Deleting wp-config.php can reset a WordPress site, giving an attacker a window to install a fresh site under their control.
• Scope of Exposure: Over 400,000 sites remain unpatched, and many administrators may not even be aware they’re running outdated versions of the Forminator plugin.
• The Fix in Version 1.44.3: We discuss how the patch restricts deletions to specific field types, limits file deletions to safe directories, and enforces path normalization and filename sanitization.
• Why WordPress Sites Are Frequent Targets: A broader look at WordPress security—including why abandoned plugins, weak file permissions, brute force attacks, and poor update hygiene continue to lead to compromises.
• Best Practices to Secure WordPress:
  • Always keep core, themes, and plugins up to date
  • Remove unused plugins and themes completely—not just deactivate them
  • Set secure file permissions (755 for directories, 644 for files, and 400 or 440 for wp-config.php)
  • Use activity logs, 2FA, and limit login attempts
  • Disable file editing in wp-config.php
  • Turn off PHP error reporting in production environments
  • Use reputable security plugins like Jetpack or Wordfence for real-time protection
• The Role of Hosting Providers: Why choosing a secure hosting platform with automatic backups, patching, and server-level firewalls makes a huge difference in your site’s security posture.
• Mitigating Plugin-Related Risks: We explain how to monitor plugins using services like WPScan and how to respond swiftly to new CVEs.

This is a wake-up call for the WordPress community: A single vulnerable plugin can bring down an entire website. Whether you manage one site or hundreds, understanding this threat and acting fast can be the difference between a minor maintenance task and a full-blown compromise.