A critical flaw in the Forminator Forms plugin for WordPress, tracked as CVE-2026-15748, exposes potentially hundreds of thousands of sites to remote code execution by unauthenticated attackers[1][3][4]. The vulnerability affects WPMU DEV’s Forminator Forms, a form builder that runs on more than 600,000 WordPress installations[3][4][11]. SecurityWeek initially highlighted the risk to WordPress sites after researchers disclosed the issue publicly.
According to the entry in the National Vulnerability Database, the issue stems from insufficient file type validation in the plugin’s handle_file_upload function, enabling arbitrary file upload[1]. The plugin uses a dangerous-extension blocklist that performs exact-key matching, which can be bypassed using alternative MIME type keys, allowing attackers to slip executable payloads past the checks[1][3]. Researchers further note that a public submission handler trusts attacker-controlled upload field configuration injected via a forged Select field value, turning a seemingly harmless form field combination into an avenue for remote code execution[1][3].
Because the flaw is exploitable without authentication, a remote attacker can upload a malicious PHP file and execute it, potentially taking complete control of the underlying WordPress site[1][4]. Ionix Threat Center classifies the bug as a CWE-434 arbitrary file upload vulnerability with a CVSS v3.1 base score of 9.8, placing it firmly in the critical severity category[4][11]. Forms built with Forminator commonly handle contact, payment, and custom workflows, so a successful compromise could expose sensitive data, enable site defacement, or provide a foothold for broader infrastructure attacks[3][4].
The vulnerability impacts all Forminator Forms versions up to and including 1.56.1, and has been patched in version 1.56.2, which plugin maintainers and security researchers urge site owners to install immediately[1][3][4]. Oxwyn Studio’s technical analysis notes that exploitation requires a form that combines both a File Upload field and a Select field, with the attacker abusing the Select field’s value to manipulate upload parameters[3]. Administrators who cannot upgrade right away are advised to temporarily disable or modify any forms using that specific field combination to reduce exposure until a full update is possible[3].
Defenders should review web server and WordPress logs for suspicious file upload activity, unexpected PHP files in upload directories, and anomalous requests to Forminator-related endpoints that may indicate exploitation attempts[1][4]. Deploying or tightening web application firewall rules around file upload handlers, enforcing strict MIME and extension validation, and monitoring for new administrative accounts or modified core files can help detect or prevent successful attacks leveraging CVE-2026-15748[1][4]. The incident underscores ongoing supply-chain risk in the WordPress plugin ecosystem, where a single critical bug in a widely used add-on can suddenly expand the attack surface across hundreds of thousands of sites worldwide[3][11].
References
- CVE-2026-15748 – NVD
- A critical flaw in one form plugin exposed … – Oxwyn Studio
- Threat Center
- CVE Brief – August 16, 2026
