Full Report
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "
Analysis Summary
# Vulnerability: Unauthenticated Remote Code Execution in Forminator Forms
## CVE Details
- **CVE ID:** CVE-2026-15748
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
- **Products:** Forminator Forms (WordPress Plugin)
- **Versions:** All versions up to and including 1.56.1
- **Configurations:** Sites are susceptible if they use a form containing both a **File Upload** field and a **Select** field.
## Vulnerability Description
The flaw exists within the `handle_file_upload()` function due to insufficient file type validation. The plugin utilizes a blocklist for dangerous file extensions that relies on exact-key matching. Attackers can bypass this validation by using "pipe-alternative MIME type keys."
Additionally, the public submission handler trusts attacker-controlled upload field configurations injected via a forged value in the Select field. While the default upload directory is typically protected by an `.htaccess` file, this protection is absent if a **Custom File Upload Storage** root is configured, as the safeguard is only generated during specific frontend requests that do not load the necessary WordPress helper.
## Exploitation
- **Status:** Disclosed (PoC status not explicitly confirmed as public, but technical details for reproduction are available in security reports).
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Total access to site data and database)
- **Integrity:** High (Ability to modify files, inject malicious code, or delete content)
- **Availability:** High (Potential for complete site takeover or deletion)
## Remediation
### Patches
- **Update to Version 1.56.2** or later (Released July 31, 2026).
### Workarounds
- Disable or remove any forms containing both a File Upload field and a Select field until the plugin is updated.
- Ensure "Custom File Upload Storage" is not used, or manually verify that the storage directory contains an `.htaccess` file (for Apache) or equivalent configuration (for Nginx) that explicitly forbids the execution of `.php` files.
## Detection
- **Indicators of Compromise:** Presence of unexpected `.php` files in the Forminator upload directories.
- **Detection methods:** Review web server logs for POST requests to Forminator submission endpoints followed by immediate GET requests to newly created files in the uploads folder.
## References
- **Wordfence Blog:** hxxps[://]www[.]wordfence[.]com/blog/2026/08/600000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/
- **The Hacker News:** hxxps[://]thehackernews[.]com/2026/08/forminator-wordpress-flaw-can-enable.html