{"metadata": {"vulnerability": "CVE-2026-89435", "count": 14, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-09-11T19:36:16.010Z", "date_only": false, "value": "2026-09-11T19:36:16.010Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-11T19:53:34Z", "date_only": false, "value": "2026-09-11T19:53:34.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89435", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-29T18:46:13Z", "date_only": false, "value": "2026-10-29T18:46:13.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89435", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-89435", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T06:56:44.521Z", "date_only": false, "value": "2026-10-30T06:56:44.521691Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117528553276260245", "record": "CVE-2026-89435", "field": "creation_timestamp", "uuid": "e8f09b1f-e272-4013-948c-6803dd2c70d6", "content": "CVE-2026-89435 Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter The Formidable Forms \u2013 WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed).\nhttps://www.cve.org/CVERecord?id=CVE-2026-89435https://www.wordfence.com/threat-intel/vulnerabilities/id/87661de6-e835-495e-9bd2-4d64b4718108?source=cvehttps://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L1514https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L1489https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/helpers/FrmAppHelper.php#L4934https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAddonsController.php#L1459https://plugins.trac.wordpress.org/browser/formidable/tags/6.35/classes/controllers/FrmAppController.php#L1167https://plugins.trac.wordpress.org/changeset?reponame=&new=3750372%40formidable%2Ftags%2F7.0&old=3688662%40formidable%2Ftags%2F6.35https://plugins.trac.wordpress.org/changeset/3746820/formidable/trunk/classes/controllers/FrmAddonsController.php#wordpress #strategy11team #FormidableForms\u2013ContactForm,Survey,Quiz,Payment,CalculatorForm&CustomFormBuilder#CVE_2026_89435#bot", "url": "https://infosec.exchange/users/cve/statuses/117528553276260245"}, {"timestamp": "2026-10-30T07:16:34Z", "date_only": false, "value": "2026-10-30T07:16:34Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7366-RQFR-5W7J", "record": "GHSA-7366-RQFR-5W7J", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-30T07:16:34.410Z", "date_only": false, "value": "2026-10-30T07:16:34.410", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89435", "record": "FKIE_CVE-2026-89435", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T07:16:34.410Z", "date_only": false, "value": "2026-10-30T07:16:34.410", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-89435", "record": "FKIE_CVE-2026-89435", "field": "lastModified"}, {"timestamp": "2026-10-30T08:14:06.074Z", "date_only": false, "value": "2026-10-30T08:14:06.074738Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/gt5bjzhvjeddb", "record": "CVE-2026-89435", "field": "creation_timestamp", "uuid": "2a86927d-0b5d-4256-b65d-6136b824abc8", "content": "CVE-2026-89435 - Formidable Forms\nCVE ID : CVE-2026-89435\n \n Published : Oct. 30, 2026, 7:16 a.m. | 13\u00a0minutes ago\n \n Description : The Formidable Forms \u2013 WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/gt5bjzhvjeddb"}, {"timestamp": "2026-10-30T09:31:25Z", "date_only": false, "value": "2026-10-30T09:31:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7366-RQFR-5W7J", "record": "GHSA-7366-RQFR-5W7J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T09:31:25Z", "date_only": false, "value": "2026-10-30T09:31:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7366-RQFR-5W7J", "record": "GHSA-7366-RQFR-5W7J", "field": "modified"}, {"timestamp": "2026-10-30T10:19:29.330Z", "date_only": false, "value": "2026-10-30T10:19:29.330232Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz3kktk4z42q", "record": "CVE-2026-89435", "field": "creation_timestamp", "uuid": "78f5b221-45ea-49ef-9785-a4f2c5a2b7cd", "content": "\ud83d\udfe0 CVE-2026-89435 - High (8.8)\n\nThe Formidable Forms \u2013 WordPress Form Builder for Contact Forms, Calculators, Quizzes & More pl...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89435/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz3kktk4z42q"}], "metrics": {"as_of": "2026-10-30T15:22:42.201Z", "anchors": {"origin": {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 30911.156231, "hours": 8.58643228638889, "days": 0.3577680119328704, "min_seconds": 30911.156231, "max_seconds": 30911.156231, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T06:47:31.045Z", "date_only": false, "value": "2026-10-30T06:47:31.045Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-89435", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T15:22:42.201Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}