How the Forminator WordPress Plugin Vulnerability Put 400,000 Sites at Risk (and What to Do Now)

25 July 2025
Jonathan Aquilina - Eagle Eye T
Cybersecurity , Plugins , Vulnerability , Wordpress

A critical vulnerability has been discovered in the popular Forminator plugin for WordPress, putting over 400,000 websites at risk of a complete takeover. If your website relies on Forminator for forms, surveys, or quizzes, this Forminator WordPress plugin vulnerability demands your immediate attention.

What Is the Forminator Plugin?

Forminator is a widely used WordPress plugin that allows website owners to easily create interactive forms, quizzes, polls, and more without writing code. Its user friendly design has made it a favorite among bloggers, small business owners, and even enterprise sites.

What Is the Vulnerability?

Researchers recently uncovered a serious security flaw in Forminator that could allow attackers to:

Gain unauthorized access to affected WordPress sites.
Escalate privileges and take over site admin accounts.
Inject malicious code or redirect site visitors.
Steal sensitive user data submitted through forms.

This vulnerability is especially dangerous because it affects both old and current versions of the plugin, and attack attempts have already been observed in the wild.

Who Is at Risk?

Any website running Forminator without the latest security update is potentially vulnerable. With over 400,000 active installations, the scale of the risk is significant including blogs, e-commerce stores, portfolios, and membership sites.

What Should Website Owners Do?

Update Forminator Immediately:
Go to your WordPress dashboard and update the Forminator plugin to the latest patched version.
Audit User Accounts:
Review site users and permissions for any unfamiliar or suspicious accounts that may have been created.
Monitor Site Activity:
Check your site logs for unusual activity or changes to critical files.
Implement Web Application Firewalls (WAF):
Adding a WAF can help block common attack patterns and protect against exploitation.
Backup Your Website:
Maintain recent backups of your files and database so you can recover quickly if your site is compromised.

Why Is Plugin Security So Important?

WordPress powers more than 40% of all websites, and plugins are a frequent target for hackers. The Forminator WordPress plugin vulnerability is a stark reminder that keeping plugins updated is essential to site security.

Final Thoughts

If you manage a WordPress site, proactive plugin management and prompt security updates are non-negotiable. The speed with which attackers exploit new vulnerabilities leaves little room for delay.