Forminator Forms up to 1.56.1 compares pipe-separated MIME type keys (such as ‘php|txt’) against its dangerous-extension blocklist as whole strings, so a key that bundles a blocked extension with an allowed one is never removed from the allowed upload types. The protective .htaccess and index.php in the Forminator uploads directory were also only created when WordPress admin functions happened to be loaded, which is never the case on a frontend form submission. Combined with a forged upload field configuration, an unauthenticated visitor can upload a PHP file and execute it.
This vulnerability affects the following application versions:
- Forminator Forms 1.23.3
- Forminator Forms 1.24.1
- Forminator Forms 1.24.4
- Forminator Forms 1.24.5
- Forminator Forms 1.24.6
- Forminator Forms 1.25.0
- Forminator Forms 1.25.1
- Forminator Forms 1.25.2
- Forminator Forms 1.26.0
- Forminator Forms 1.27.0
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2
- Forminator Forms 1.29.3
- Forminator Forms 1.30.2
- Forminator Forms 1.31.0
- Forminator Forms 1.32.0
- Forminator Forms 1.33.0
- Forminator Forms 1.34.0
- Forminator Forms 1.34.1
- Forminator Forms 1.35.0
- Forminator Forms 1.35.1
- Forminator Forms 1.36.0
- Forminator Forms 1.36.1
- Forminator Forms 1.36.2
- Forminator Forms 1.36.3
- Forminator Forms 1.37.1
- Forminator Forms 1.38.1
- Forminator Forms 1.38.2
- Forminator Forms 1.38.3
- Forminator Forms 1.39.0
- Forminator Forms 1.39.1
- Forminator Forms 1.39.2
- Forminator Forms 1.39.3
- Forminator Forms 1.40.0
- Forminator Forms 1.41.1
- Forminator Forms 1.41.2
- Forminator Forms 1.42.0
- Forminator Forms 1.42.1
- Forminator Forms 1.42.2
- Forminator Forms 1.43.0
- Forminator Forms 1.43.1
- Forminator Forms 1.44
- Forminator Forms 1.44.1
- Forminator Forms 1.44.2
- Forminator Forms 1.44.3
- Forminator Forms 1.45
- Forminator Forms 1.45.1
- Forminator Forms 1.46.1
- Forminator Forms 1.46.2
- Forminator Forms 1.47
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0
- Forminator Forms 1.49.2
- Forminator Forms 1.50.1
- Forminator Forms 1.50.3
- Forminator Forms 1.51
- Forminator Forms 1.51.1
- Forminator Forms 1.52
- Forminator Forms 1.52.1
- Forminator Forms 1.52.2
- Forminator Forms 1.53.0
- Forminator Forms 1.53.0.1
- Forminator Forms 1.53.1
- Forminator Forms 1.53.2
- Forminator Forms 1.54
- Forminator Forms 1.54.0
- Forminator Forms 1.55.0
- Forminator Forms 1.55.0.1
- Forminator Forms 1.55.0.2
- Forminator Forms 1.55.1
- Forminator Forms 1.56.0
- Forminator Forms 1.56.0.1
- Forminator Forms 1.56.0.2
- Forminator Forms 1.56.1