Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

// library/modules/custom-forms/front/front-action.php

private static function handle_upload_field( $field_settings ) {
	if ( self::$is_draft || self::$is_abandoned ) {
		return;
	}

	$file_type     = Forminator_Field::get_property( 'file-type', $field_settings, 'single' );
	$upload_method = Forminator_Field::get_property( 'upload-method', $field_settings, 'ajax' );
	$field_id      = Forminator_Field::get_property( 'element_id', $field_settings );

	$form_upload_data = isset( self::$prepared_data['forminator-multifile-hidden'] )
		? self::$prepared_data['forminator-multifile-hidden']
		: array();

	$upload_data = isset( $form_upload_data[ $field_id ] )
		? $form_upload_data[ $field_id ]
		: Forminator_Core::sanitize_text_field( $field_id );

	if ( ! empty( $upload_data ) ) {
		self::$has_upload                         = true;
		self::$prepared_data[ $field_id ]['file'] = $upload_data;
	} else {
		self::$prepared_data[ $field_id ] = '';
	}
}

---

// library/abstracts/abstract-class-mail.php

public function set_attachment( $attachment, $custom_form = null, $entry = null ) {
	// Set email context to false to avoid replacing images in PDFs.
	$old_value              = self::$is_email_context;
	self::$is_email_context = false;
	$this->attachment       = apply_filters( 'forminator_custom_form_mail_attachment', $attachment, $custom_form, $entry, $this->pdfs );
	self::$is_email_context = $old_value;
}

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.1/library/abstracts/abstract-class-mail.php /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.2/library/abstracts/abstract-class-mail.php
--- /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.1/library/abstracts/abstract-class-mail.php	2025-10-20 10:50:06.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.2/library/abstracts/abstract-class-mail.php	2026-04-07 11:40:02.000000000 +0000
@@ -351,11 +351,33 @@
 		// Set email context to false to avoid replacing images in PDFs.
 		$old_value              = self::$is_email_context;
 		self::$is_email_context = false;
+		$attachment             = $this->filter_attachments( $attachment );
 		$this->attachment       = apply_filters( 'forminator_custom_form_mail_attachment', $attachment, $custom_form, $entry, $this->pdfs );
 		self::$is_email_context = $old_value;
 	}
 
 	/**
+	 * Filter attachments to make sure only files in upload dir can be attached.
+	 *
+	 * @param array $attachments Attachments to filter.
+	 * @return array
+	 */
+	private function filter_attachments( $attachments ) {
+		if ( ! empty( $attachments ) ) {
+			$upload_dir = wp_upload_dir();
+			if ( ! empty( $upload_dir['basedir'] ) ) {
+				foreach ( $attachments as $key => $attachment ) {
+					if ( 0 !== strpos( $attachment, $upload_dir['basedir'] ) ) {
+						unset( $attachments[ $key ] );
+					}
+				}
+			}
+		}
+
+		return $attachments;
+	}
+
+	/**
 	 * Set headers
 	 *
 	 * @since 1.0
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.1/library/modules/custom-forms/front/front-action.php /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.2/library/modules/custom-forms/front/front-action.php
--- /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.1/library/modules/custom-forms/front/front-action.php	2026-04-07 11:36:16.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/forminator/1.52.2/library/modules/custom-forms/front/front-action.php	2026-04-07 11:40:02.000000000 +0000
@@ -599,7 +599,7 @@
 		$element_id  = Forminator_Field::get_property( 'element_id', $field_array );
 
 		if ( self::$is_draft ) {
-			if ( in_array( $field_type, array( 'hidden', 'stripe', 'stripe-ocs', 'paypal', 'signature' ), true ) ) {
+			if ( in_array( $field_type, array( 'hidden', 'stripe', 'stripe-ocs', 'paypal', 'signature', 'upload' ), true ) ) {
 				return;
 			}
 
@@ -2578,13 +2578,15 @@
 	 * @param array $field_settings Field settings.
 	 */
 	private static function handle_upload_field( $field_settings ) {
+		$field_id = Forminator_Field::get_property( 'element_id', $field_settings );
+		// Initialize upload field data as an empty array to prevent setting data from POST data.
+		self::$prepared_data[ $field_id ] = array();
 		if ( self::$is_draft || self::$is_abandoned ) {
 			return;
 		}
 
 		$file_type     = Forminator_Field::get_property( 'file-type', $field_settings, 'single' );
 		$upload_method = Forminator_Field::get_property( 'upload-method', $field_settings, 'ajax' );
-		$field_id      = Forminator_Field::get_property( 'element_id', $field_settings );
 
 		$form_upload_data = isset( self::$prepared_data['forminator-multifile-hidden'] )
 			? self::$prepared_data['forminator-multifile-hidden']
@@ -2599,8 +2601,6 @@
 		if ( ! empty( $upload_data ) ) {
 			self::$has_upload                         = true;
 			self::$prepared_data[ $field_id ]['file'] = $upload_data;
-		} else {
-			self::$prepared_data[ $field_id ] = '';
 		}
 	}