Japan’s CERT has warned of critical vulnerabilities in the Forminator WordPress plugin.

The flaws could allow remote attackers to upload malicious code and access sensitive information.

The specific vulnerability is identified as CVE-2024-28890, impacting over 300,000 sites.

Forminator's latest version, 1.29.3, patches these security issues.

Despite the fix, over 200,000 WordPress sites remain vulnerable.

WPMU DEV has released a patch and users are strongly encouraged to update immediately.

Website admins should regularly update all software components and deactivate unused add-ons for security.