CVE-2026-89435
Deferred Deferred - Pending Action

Arbitrary Plugin Installation in Formidable Forms WordPress Plugin

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: Wordfence

Description
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-31
AI Q&A
2026-10-30
EPSS Evaluated
2026-10-30
NVD
CVE-2026-89435
EUVD
EUVD-2026-113736

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Formidable Forms WordPress plugin. It allows authenticated attackers with subscriber-level access or higher to install arbitrary plugins on the server. The issue stems from insufficient URL validation and a weak permission check that relies on a shared token instead of proper plugin installation capabilities.

Detection Guidance

Check WordPress sites for unauthorized plugin installations by reviewing the plugins list in the admin dashboard. Look for unfamiliar plugins or recent installations. Use server logs to search for POST requests to /wp-admin/admin-post.php with the 'file_url' parameter.

Impact Analysis

An attacker could exploit this to install malicious plugins, potentially taking control of your WordPress site, stealing data, or disrupting operations. The attack requires only subscriber-level access, making it dangerous even for low-privilege users.

Compliance Impact

This vulnerability could lead to unauthorized plugin installations, potentially violating compliance requirements for data protection (GDPR) or healthcare data (HIPAA) by exposing sensitive data or failing security controls due to untrusted plugins.

Mitigation Strategies

Update Formidable Forms to the latest version if available. Remove the 'frm_view_forms' capability from subscriber-level users. Disable plugin installation permissions for non-admin users. Monitor for unauthorized plugin installations and review server logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89435. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart