Critical Forminator Plugin Flaw Can Delete Your Site’s Core Files

CVE-2025-6463 is a high-severity vulnerability in the Forminator Forms WordPress plugin (< v1.44.3) that allows unauthenticated attackers to delete arbitrary files on the server by exploiting unsafe file path handling. If an admin deletes a form entry linked to a malicious submission, critical files like wp-config.php can be removed, potentially leading to full site compromise. With over 600,000 active installations, all users of the Forminator plugin are strongly urged to update immediately or disable the plugin until they can safely upgrade.