Advisory · CVE-2026-89435
Formidable Forms lets a subscriber-level account install arbitrary plugins
Formidable Forms for WordPress, in versions up to and including 6.35, lets an authenticated attacker with subscriber-level access install arbitrary plugins, because a permission callback relies on a shared token instead of checking install and activate capabilities. Rated high at CVSS 3.1 8.8.
- Vendor
- Strategy11
- Product
- Formidable Forms
- Identifier / CWE
- CVE-2026-89435
CWE-74 - Action timing
- Immediate
Explain it like I’m five
A low-level account on a site can ask the form plugin to fetch and install a new plugin, because the plugin checks a shared password instead of checking whether that account is allowed to install anything. Installing a plugin is the same as getting full control of the site.
- 01Subscriber account signs in
The attacker holds any authenticated account at Subscriber level or above on a site running Formidable Forms up to 6.35 without Formidable Pro installed.
- 02Shared token obtained
The attacker obtains the shared token that the permission callback relies on, which is available to any user with the delegable frm_view_forms capability.
- 03Plugin install requested
The attacker calls the plugin installation path with a file_url parameter, which passes insufficient URL prefix validation in validate_url_is_in_s3_bucket().
- 04Arbitrary plugin installed
Because install_plugins and activate_plugins capabilities are never checked, the arbitrary plugin is installed on the server.
- 05Site takeover
The installed plugin gives the attacker full control of the WordPress site.
What happened
Wordfence disclosed CVE-2026-89435, published in NVD on October 30, 2026 and rated high at CVSS 3.1 8.8: the Formidable Forms plugin for WordPress is vulnerable to arbitrary plugin installation (CWE-74) in all versions up to, and including, 6.35, via the file_url parameter. The flaw is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() combined with a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. Authenticated attackers with subscriber-level access and above can therefore install arbitrary plugins on the server.
Exploitation additionally requires that the site is free-only, meaning Formidable Pro is not installed. The NVD record references a changeset that tags Formidable Forms 7.0, and the vendor changelog lists 7.0 as released on October 14, 2026, so sites should update to Formidable Forms 7.0 or later. Formidable Forms is widely deployed, with over 400,000 active sites reported.
What to do
- Inventory WordPress sites running Formidable Forms and note the version of each, including staging and client sites, and whether Formidable Pro is installed.
- Update Formidable Forms to version 7.0 or later on every free-only site running 6.35 or earlier, and verify the deployed version afterwards.
- Until a site is updated, review subscriber-level accounts and remove any you do not recognize, and consider disabling open registration.
- Review the installed plugin list for plugins nobody on the team installed, and check administrator accounts for unexpected changes.
- If an unexpected plugin or admin change is found, remove the plugin, reset administrator passwords, rotate WordPress salts and any credentials reachable from the site, and scan the site for added files or content.
Management note
Subscriber is the lowest rung on a WordPress site, and this flaw turns it into full site control on free-only installs. Any site that allows public registration should treat the update as urgent, and an unknown plugin in the list is a compromise indicator, not clutter.