FORMINATOR PLUGIN FLAW EXPOSES WORDPRESS SITES TO TAKEOVER ATTACKS

Summary from the TLDR InfoSec newsletter

The WordPress Forminator plugin (versions up to 1.44.2) contains a critical vulnerability (CVE-2025-6463, CVSS 8.8) that affects 600,000+ sites. Attackers can exploit insufficient input validation to delete critical files like wp-config.php, forcing sites into setup mode for complete takeover. Version 1.44.3 patches this flaw—immediate updates are essential.