CVE-2026-89435 - The Formidable Forms โ WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vul
The Formidable Forms โ WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
HIGH
Severity & confidence
Source severityhigh
Platform severityhigh
Confidencehigh
Exploitationunknown
CVSS8.8
Affected
Vendorswordpress
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-30T07:16:34
Last updated2026-11-02T07:14:02
Ingested2026-11-01T15:23:55
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
