WordPress Alert: Forminator Plugin Flaw Could Lead to Full Site Takeover (CVE-2025-6463)

🚨 WordPress Alert: Massive Zero-Day in Forminator Plugin (CVE-2025-6463) 🚨

A critical security flaw has been discovered in the widely used Forminator plugin for WordPress — impacting over 600,000 active websites. Tracked as CVE-2025-6463, this unauthenticated site takeover vulnerability allows attackers to delete wp-config.php and trigger full WordPress reinstallation, opening the door to total site compromise — no credentials needed.

🧨 What Happened?
Forminator, developed by WPMU DEV, is a popular drag-and-drop form builder used for contact forms, quizzes, and polls. But up to version 1.44.2, it contained a major flaw in the way it processed form input fields — particularly fake file paths submitted via normal text fields.

👨‍💻 A researcher discovered that attackers could:
🔸 Submit malicious form data with a fake file upload path
🔸 Point that path to critical files like wp-config.php
🔸 Trigger auto-deletion when the form is removed or expires
🔸 Cause WordPress to re-enter setup mode
🔸 Connect it to a rogue DB and hijack the entire site

🕵️‍♂️ The vulnerability was responsibly disclosed by Phat RiO – BlueRock, validated by Wordfence, and patched within days. On June 30, 2025, version 1.44.3 was released, limiting file deletions and hardening input validation.

🛡️ What You Must Do Now
⚠️ If your site runs Forminator:
✅ Update immediately to version 1.44.3
⛔ If you can't update right away, disable the plugin until you can
📊 Check your logs for unusual form activity or deletions

This vulnerability is easy to exploit and now publicly known — mass scanning and exploitation attempts are expected to follow rapidly.

📌 Timeline of Events
📆 June 20 – Vulnerability reported
📆 June 23 – Validated and disclosed to vendor
📆 June 30 – Patch released in version 1.44.3
📈 200,000+ downloads of patched version already, but many remain exposed

🔐 Takeaways
✔️ Stay vigilant with plugins
✔️ Subscribe to CVE updates
✔️ Monitor file changes and disable unnecessary auto-delete features
✔️ Practice proactive patch management — especially on form-related tools

📣 Stay Safe & Spread the Word
This is a reminder that even the most trusted plugins can contain devastating flaws. Protect your WordPress site — act now.

#WordPressSecurity #CVE20256463 #ForminatorPlugin #WPMUDEV #WebsiteHacked #ZeroDay #WordPressVulnerability #CyberSecurity #WPConfigExploit #BlueRock #Wordfence #PatchNow #MalwareAlert #CyberThreats #SiteTakeover #WPPluginSecurity

FIND US AT
https://dailysecurityreview.com/

FOLLOW US ON SOCIAL
Get updates or reach out to Get updates on our Social Media Profiles!
Twitter: https://twitter.com/securitydailyr
Facebook: https://www.facebook.com/profile.php?id=100086307206534
LinkedIn: https://www.linkedin.com/company/security-daily-review

Видео WordPress Alert: Forminator Plugin Flaw Could Lead to Full Site Takeover (CVE-2025-6463) канала Security Daily Review