WordPress Forminator Plugin Faces Critical Form Takeover Vulnerability
A newly discovered form takeover vulnerability in WordPress plugin Forminator is putting hundreds of thousands of websites at risk. This high-severity flaw could allow hackers to delete key WordPress configuration files and hijack entire websites. If you’re using the Forminator plugin for contact forms, surveys, or payment processing, here’s what you need to know—and how to protect your site fast. Security researchers have warned that failing to update Forminator can result in full admin-level access for attackers.
How the Forminator Form Takeover Vulnerability Works
The vulnerability stems from poor validation and sanitation in form field inputs. According to a security expert known as “Phat RiO – BlueRock,” attackers can exploit the flaw to upload a custom file and trick Forminator into deleting the wp-config.php file—the core of your WordPress installation. This pushes the site into setup mode, allowing the attacker to reconfigure the database and take full control. Tracked as CVE-2025-6463, this bug affects all versions of the plugin up to 1.44.2 and has been rated 8.8/10 in severity.
Who’s at Risk and What You Should Do Now
If you use Forminator on your site, especially versions older than 1.44.3, you are at risk. More than 100,000 WordPress sites may currently be vulnerable. The good news? A patch has been released, and updating the plugin immediately will remove the risk of a site takeover. Website owners should also check for unusual activity and enable file integrity monitoring. Plugins like Wordfence or Sucuri can help detect and block similar exploit attempts.
How to Prevent WordPress Plugin Vulnerabilities in the Future
To stay ahead of future security issues like this form takeover vulnerability in WordPress plugin, follow these best practices:
-
Always keep plugins, themes, and WordPress core updated
-
Use reputable plugins with frequent security patches
-
Enable two-factor authentication for admin logins
-
Regularly back up your website and monitor for suspicious behavior
Security flaws are inevitable, but with proactive steps and quick action on updates, you can safeguard your WordPress site from serious threats.
Comment