CVE-2026-89435
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Formidable Forms plugin for WordPress in versions up to and including 6.35 is vulnerable to Arbitrary Plugin Installation via the 'file_url' parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback relying solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins. Authenticated attackers with subscriber-level access and above can install arbitrary plugins, provided the site is free-only (Formidable Pro is not installed).
Risk Assessment
A low-privileged attacker can install malicious plugins, potentially leading to site takeover or code execution.
Recommendation
Update Formidable Forms to a version later than 6.35 and restrict the frm_view_forms capability to trusted roles.
Other vulnerabilities in Formidable Forms
See all- CVE-2026-19857Medium
The Formidable Forms WordPress plugin before version 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML. This allows unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
- CVE-2026-85641Medium
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values. This allows unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
- CVE-2026-18331High
The Formidable Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. By forging frm_user_id to match an administrator's user ID, the attacker causes wp_kses_post() to be the only filter, and the script executes automatically.
- CVE-2026-11361Medium
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete. This allows unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.
Original NVD description (English source)
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS