Vulnerability in Strategy11team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Builder

CVE-2026-89435

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.004 (33.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 33.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-89435?
CVE-2026-89435 is a high-severity vulnerability in Strategy11team Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Builder, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2026-10-30.
How severe is CVE-2026-89435?
High severity. CVSS v3 base score is 8.8 out of 10.