A critical flaw (CVE-2026-15748) in the Forminator Forms plugin allows unauthenticated attackers to execute remote code, potentially compromising hundreds of thousands of websites.

  • A critical RCE vulnerability (CVE-2026-15748) has been identified in the Forminator Forms plugin.
  • Attackers can bypass file type restrictions to upload malicious executable files.
  • Over 300,000 websites are estimated to be running vulnerable versions.

Cybersecurity firm Defiant has issued a high-priority warning regarding a critical vulnerability in the Forminator Forms plugin for WordPress. The flaw, tracked as CVE-2026-15748, carries a devastating CVSS score of 9.8, making it one of the most dangerous recent discoveries in the WordPress ecosystem.

Technical Deep Dive

The vulnerability resides within the handle_file_upload function. Due to insufficient validation of file types, unauthenticated attackers can exploit the plugin's logic to bypass existing blocklists. By manipulating the 'Select field' configuration, an attacker can inject malicious MIME type keys that the plugin fails to recognize as dangerous, allowing for the upload of executable PHP files.

Read Also:Weak Security Fuels Russian Cyber Attacks as UK and EU Impose Joint Sanctions

A significant risk factor involves websites using a Custom File Upload Storage root. While default configurations often protect against PHP execution in certain directories, custom configurations bypass these protections, allowing an attacker to execute code simply by requesting the uploaded file directly.

This flaw can lead to complete site compromise through the use of webshells and other advanced exploitation techniques.

Why This Matters

BozokMedia analysis shows that the scale of this threat is massive. With over 600,000 installations of Forminator, data suggests that roughly 50% of users are running versions prior to the patch. This leaves approximately 300,000 websites wide open to remote code execution (RCE), which can result in total data theft or server hijacking.

Historical Background

Arbitrary file upload vulnerabilities have been a persistent Achilles' heel for web plugins for decades. From early SQL injections to modern-day RCE flaws, the evolution of these attacks shows that as software becomes more complex, the surface area for critical errors like insufficient input validation continues to grow.

Did You Know?: WordPress powers over 43% of the entire web, making any plugin vulnerability a potential global security event.

Frequently Asked Questions

Q1: Which versions are affected?
A: All versions of Forminator Forms up to and including 1.56.1 are vulnerable.

Q2: How can I secure my site?
A: Immediately update your Forminator plugin to version 1.56.2 or higher, which was released on July 31 to patch this issue.