Formidable Forms, a 300,000-install plugin, lets subscribers add plugins
CVE-2026-89435 lets a logged-in subscriber trick the free version into installing an attacker-chosen plugin, through a URL check that does not verify the domain it claims to.
Formidable Forms, a WordPress form builder with over 300,000 active installs, has a flaw disclosed on 30 October that lets a logged-in subscriber install an arbitrary plugin on the site. CVE-2026-89435, rated 8.8, sits in validate_url_is_in_s3_bucket(): the function is meant to check that a download URL points at Formidable’s own S3 bucket before fetching and installing it, but checks the URL prefix loosely enough that an attacker-controlled address can pass. The permission callback guarding the install endpoint only requires the frm_view_forms capability, not install_plugins or activate_plugins, so an account with no business installing anything can still reach it.
It only affects the free plugin, versions up to and including 6.35; sites running Formidable Pro are not exposed. Version 7.0 fixes it. The plugin’s own changelog does not name the CVE, but describes the same two changes: “additional permission checks have been added to prevent unauthorized plugin installations” and “download URL validation has been hardened to prevent downloads from untrusted sources.”
Why it matters: subscriber is the role WordPress hands out by default to anyone who registers, and a form builder is exactly the kind of plugin that ships with open registration or public quiz and survey forms switched on. If your site runs the free version of Formidable Forms and allows any kind of self-registration, update to 7.0 rather than treating this as a routine bump.
The caveat: Formidable has not published its own security bulletin naming the CVE, so the mechanism here comes from Strix’s write-up and the plugin’s changelog, not a vendor advisory. There is no report yet of this being exploited in the wild.