Forminator Forms WordPress Plugin Path Traversal Vulnerability Allowing Unauthenticated Arbitrary File Read

A path traversal vulnerability has been identified in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress, affecting versions through 1.52.1. The vulnerability arises in the 'upload-1[file][file_path]' parameter, allowing unauthenticated attackers to read arbitrary files on the server that may contain sensitive information. Exploitation requires a publicly accessible form with a File Upload field, where the Save and Continue option is enabled and configured to attach uploaded files via email.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information stored in files on the server.

Remediation

Users are advised to update the Forminator Forms plugin to version 1.52.2 or a newer patched version.