WordPress Plugin Vulnerability Report – Forminator – Authenticated (Administrator+) Arbitrary File Upload – CVE-2023-6133

Plugin Name: Forminator

Key Information:

  • Software Type: Plugin
  • Software Slug: forminator
  • Software Status: Active
  • Software Author: wpmudev
  • Software Downloads: 5,677,838
  • Active Installs: 400,000
  • Last Updated: November 14, 2023
  • Patched Versions: 1.28.0
  • Affected Versions: <= 1.27.0

Vulnerability Details:

  • Name: Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload
  • Type: Unrestricted Upload of File with Dangerous Type
  • CVE: CVE-2023-6133
  • CVSS Score: 6.6 (Medium)
  • Publicly Published: November 14, 2023
  • Researcher: István Márton
  • Description: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary files on the affected site's server, but due to the htaccess configuration, remote code cannot be executed.


The Forminator plugin for WordPress has a vulnerability in versions up to and including 1.27.0 that allows authenticated attackers with administrative privileges to upload arbitrary files. This vulnerability has been patched in version 1.28.0.

Detailed Overview:

This vulnerability was identified by researcher István Márton. It resides in the 'forminator_allowed_mime_types' function, where insufficient blacklisting enables the upload of potentially harmful files. While the htaccess configuration of the plugin prevents remote code execution, the flaw still poses a significant risk. The potential for misuse by authenticated users with administrative access underscores the need for stringent access controls and regular security audits.

Advice for Users:

  • Immediate Action: Update to the patched version 1.28.0.
  • Check for Signs of Vulnerability: Monitor file uploads for unusual or unexpected files.
  • Alternate Plugins: Consider using alternative plugins with similar functionality as a precaution.
  • Stay Updated: Regularly update your plugins to the latest versions to mitigate vulnerabilities.


The swift action by the Forminator developers to release a patch for this vulnerability highlights the critical importance of timely software updates. To ensure the security of WordPress installations, users should upgrade to version 1.28.0 or later.


Detailed Report:

In an age where websites serve as the cornerstone of our online presence, the importance of cybersecurity cannot be overstated. A recent vulnerability discovered in the widely used Forminator plugin for WordPress serves as a critical reminder of this fact. As a small business owner, staying informed and proactive about such vulnerabilities is crucial, not just for the functionality and aesthetics of your website, but more importantly, for its security and the safety of your users.

Plugin Overview:

Forminator, a popular WordPress plugin developed by wpmudev, is a versatile tool used for creating forms, polls, and quizzes. It boasts over 400,000 active installations and has been downloaded more than 5.6 million times. Despite its popularity and utility, Forminator has had its share of security concerns, with 11 vulnerabilities reported since February 2019.

Vulnerability Details:

The latest vulnerability, identified as CVE-2023-6133, is particularly concerning. It allows authenticated users with administrative privileges to upload arbitrary files. This vulnerability stems from insufficient blacklisting in the 'forminator_allowed_mime_types' function, affecting all versions up to and including 1.27.0. Although it does not allow remote code execution due to the htaccess configuration, the potential for misuse is significant.

Risks and Potential Impacts:

This vulnerability poses a considerable risk, primarily to websites that grant administrative access to multiple users. An attacker with administrative rights could exploit this flaw to upload harmful files, potentially leading to data breaches or compromising the integrity of the website.


The developers of Forminator have released a patched version, 1.28.0, that addresses this vulnerability. Immediate action is required: update your Forminator plugin to this latest version. Regularly updating your plugins is not just a maintenance task; it's a critical security measure.

Historical Vulnerabilities:

Since 2019, Forminator has experienced 11 documented vulnerabilities, ranging from cross-site scripting to unauthorized data exposure. Each of these vulnerabilities has been addressed in subsequent updates. This history underscores the importance of regular updates and vigilance in monitoring the security of your website's plugins.

Final Thoughts:

For small business owners, managing a WordPress site can be challenging, especially when it comes to staying on top of security vulnerabilities. It's essential to understand that outdated plugins are prime targets for attackers. Ensuring that your website is running the latest versions of plugins and themes is crucial for security.

Don't tackle WordPress security alone - the consequences of a breach are too great. At Your WP Guy, our managed WordPress maintenance services include layers of protection like auto-updates, malware scanning, firewalls and 24/7 monitoring by WordPress experts. We become your outsourced IT team.

Let's chat about migrating your site to our managed hosting so you can finally stop worrying about security issues. We'll fully audit and lock down your site as part of onboarding. Call us at 678-995-5169 to keep your business safe online.

WordPress Plugin Vulnerability Report – Forminator – Authenticated (Administrator+) Arbitrary File Upload – CVE-2023-6133 FAQs

Leave a Comment