CVE-2025-6464

Deeper analysis

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.44.2. The flaw arises from unsafe deserialization of untrusted input inside the entry_delete_upload_files function, which accepts a PHAR file and can instantiate attacker-controlled objects. No POP chain exists in the plugin itself, so the issue only becomes exploitable when another plugin or theme supplying a usable chain is also installed on the site.

An unauthenticated attacker can trigger the vulnerability by submitting a specially crafted form entry that is later deleted, either manually by an administrator or automatically according to plugin settings. When a POP chain is present, successful exploitation may allow deletion of arbitrary files, disclosure of sensitive data, or remote code execution, depending on the chain available. The CVSS 7.5 rating reflects the high impact under these conditions combined with the network attack vector and required user interaction.

Advisories and code references from the Wordfence threat intelligence database and the plugin’s Trac repository indicate that the issue is resolved by updating to a version newer than 1.44.2; the published changeset addresses the unsafe deserialization path. The associated EPSS score has remained flat at 0.0215 with no material increase since disclosure.