A severe vulnerability in the Forminator Forms plugin, used by over 600,000 sites, allows attackers to execute arbitrary code via malicious PHP uploads without authentication.

  • Critical vulnerability CVE-2026-15748 discovered in Forminator Forms.
  • Assigned a severe CVSS score of 9.8/10.0.
  • Allows unauthenticated Remote Code Execution (RCE) via malicious PHP uploads.

A major security alert has been issued for the WordPress community. Forminator Forms, a widely adopted plugin with over 600,000 active installations, has been found to contain a critical vulnerability that could lead to total system compromise. The flaw allows an external attacker to upload and execute malicious PHP scripts on a susceptible server without needing any login credentials.

The vulnerability, identified as CVE-2026-15748, has been rated 9.8 out of 10.0 on the CVSS scale. This near-perfect score indicates that the exploit is highly accessible and carries an extreme impact. By leveraging this flaw, a threat actor can gain full administrative control over the WordPress installation, potentially leading to massive data breaches or the deployment of ransomware.

Read Also:Samsung’s Flex Titanium: A New Era for Foldable Durability

Why This Matters

BozokMedia analysis shows that the prevalence of such flaws in high-install plugins creates a massive attack surface for automated bots. When a plugin with 600k+ installs is compromised, it isn't just one site at risk—it is an entire ecosystem of businesses. This highlights a systemic failure in rigorous input sanitization and file upload validation protocols within the plugin's architecture.

"Unauthenticated RCE is the 'holy grail' for hackers, as it removes the need for stolen passwords to penetrate a system."

Historically, file upload vulnerabilities have plagued WordPress plugins. Attackers typically bypass client-side restrictions to upload executable files. In this specific case, the lack of server-side verification allowed the PHP files to be processed, granting the attacker a shell on the server. The discovery was made by an independent security researcher who acted responsibly by reporting the bug before it was widely exploited in the wild.

Did You Know?: Remote Code Execution (RCE) is considered one of the most dangerous types of cyberattacks because it grants the attacker the same privileges as the server administrator.

Frequently Asked Questions

Q1: Is my website affected by this flaw?
If you are using an outdated version of Forminator Forms, your site is potentially vulnerable. Update to the latest version immediately.

Q2: What is the risk of an RCE attack?
The risk includes total data loss, theft of user databases, and the ability for hackers to use your server to launch further attacks.