PHP Object Injection Vulnerability in Forminator Forms Plugin for WordPress
CVE-2025-6464
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 2 July 2025
What is CVE-2025-6464?
The Forminator Forms plugin for WordPress is susceptible to PHP Object Injection due to improper handling of untrusted input in the 'entry_delete_upload_files' function. This vulnerability allows attackers to exploit deserialization when form entries are deleted. While the risk is mitigated if no additional plugins with a PHP Object Injection (POP) chain are installed, if such a chain exists, it could enable attackers to delete files, extract sensitive information, or execute arbitrary code, amplifying the overall risk to site integrity.
Affected Version(s)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder * <= 1.44.2