CVE-2025-6464: 
WordPress vulnerability analysis and mitigation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.44.2. The vulnerability exists in the 'entrydeleteupload_files' function through deserialization of untrusted input. This vulnerability was discovered in July 2025 and affects the WordPress plugin Forminator (NVD, CVE).

The vulnerability allows unauthenticated attackers to inject PHP Objects through a PHAR file via the deserialization of untrusted input in the 'entrydeleteupload_files' function. The deserialization occurs when form submissions are deleted, either by an administrator or through auto-deletion settings. The vulnerability has been assigned a CVSS v3.1 score of 7.5 HIGH (NVD).

While no known POP (Property Oriented Programming) chain is present in the vulnerable software itself, if a POP chain exists via an additional plugin or theme installed on the target system, attackers could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code depending on the available POP chain (NVD).

The vulnerability has been patched in version 1.44.3 of the Forminator plugin. Users are advised to update to this version immediately (WordPress Changeset).