CVE-2025-6463

CVE-2025-6463 is a critical arbitrary file deletion vulnerability affecting the Forminator Forms WordPress plugin (versions up to 1.44.2), impacting over 600,000 websites. Unauthenticated attackers can exploit insufficient file path validation to delete arbitrary files, including critical system files like wp-config.php, potentially leading to remote code execution and full site compromise. With a CVSS score of 8.8 (High), this vulnerability is easily exploitable with low attack complexity, requiring only user interaction to trigger the deletion. While no public exploit code or active exploitation has been confirmed, the vulnerability has garnered significant community discussion and media attention, indicating a high potential for future exploitation.