Formidable Forms: Arbitrary Plugin Installation (CVE-2026-89435)
The Formidable Forms WordPress plugin is vulnerable to arbitrary plugin installation via the 'file_url' parameter in versions up to and including 6.35.
CVE search metadata
CVE search record: CVE-2026-89435. Severity: high. CVSS: 8.8. KEV: no. Product: Formidable Forms (<= 6.35). Brief: Formidable Forms: Arbitrary Plugin Installation (CVE-2026-89435). Brief link: https://feed.craftedsignal.io/briefs/2026-10-formidable-forms-rce/
Triage facts
Revision 1- Applicability
- Formidable Forms (<= 6.35)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 13:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Formidable Forms plugin for WordPress (all versions up to and including 6.35) is vulnerable to arbitrary plugin installation. The issue arises from insufficient URL prefix validation in the 'validate_url_is_in_s3_bucket()' function and a permission callback that relies on a shared token accessible to users with the 'frm_view_forms' capability, without checking for 'install_plugins' or 'activate_plugins' privileges. The vulnerability is exploitable by authenticated users with subscriber-level access and above, provided the site is using the free version of the plugin (Formidable Pro is not installed).