Do Son 
TL;DR
A critical flaw in Forminator Forms puts more than 600,000 WordPress sites at risk. Tracked as CVE-2026-15748, it scores a CVSS 9.8. The bug lets unauthenticated attackers upload executable PHP files, which opens the door to pre-auth remote code execution and full site takeover. Users should update to version 1.56.2 now.
Why It Matters
Forminator is a popular drag-and-drop form builder for WordPress. The Forminator Forms plugin runs on over 600,000 active sites, per Wordfence estimates. This CVE-2026-15748 flaw needs no login, no account, and no user interaction.
A successful upload can plant a webshell on the server. From there, an attacker can seize the whole site. Because the flaw is unauthenticated, automated scanners can hunt for vulnerable sites at scale.
How the Attack Works
The flaw is not a single bug. Instead, it chains several weaknesses in the plugin’s upload path. Exploitation only works on forms that contain both a File Upload field and a Select field.
Forged Upload Record
Forminator‘s request sanitizer returns the full nested value of Select fields unchanged. An attacker abuses that behavior to smuggle a forged record through the Select field. The record falsely declares itself an Upload field and supplies its own configuration.
Blocklist Bypass
Once a real File Upload field exists, the plugin processes the forged record too. The attacker then controls the allowed file types. A blocklist should strip the php extension, yet it uses exact-key matching.
According to Wordfence, the pattern ph(p) slips past that check. WordPress still reads ph(p) as a match for the .php suffix. As a result, the malicious PHP file passes validation. This report omits any working exploit steps.
Affected Versions
The vulnerability affects all Forminator Forms versions up to and including 1.56.1. The flaw sits in the handle_file_upload function.
By default, uploads land in a directory protected by an .htaccess file that blocks PHP execution. However, a custom upload storage root can miss that protection. In that setup, requesting the uploaded file runs the attacker’s code.
Exploitation Status
Researcher “daroo” reported the flaw through the Wordfence Bug Bounty Program and earned a 2,048 dollar bounty. No in-the-wild exploitation has been confirmed so far. No public proof-of-concept exploit has been released either.
Patch and Mitigation Steps
Update Forminator Forms to version 1.56.2 as soon as possible. After updating, review any forms that combine file upload and select fields. You should also audit upload directories for unexpected PHP files. Check that custom upload roots carry .htaccess protection. Prompt patching remains the strongest defense given the CVSS 9.8 rating.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
