CVE-2026-89435 | strategy11team Formidable Forms Plugin up to 6.35 on WordPress Permission Callback validate_url_is_in_s3_bucket file_url permission

October 30, 2026 Yanac

A vulnerability, which was classified as critical, was found in strategy11team Formidable Forms Plugin up to 6.35 on WordPress. The affected element is the function validate_url_is_in_s3_bucket of the component Permission Callback. Executing a manipulation of the argument file_url can lead to permission issues.

This vulnerability is tracked as CVE-2026-89435. The attack can be launched remotely. No exploit exists.VulDB Recent EntriesRead More