Critical Arbitrary File Upload Vulnerability in Forminator Forms Affects 600,000 WordPress Sites

A critical security vulnerability, tracked as CVE-2026-15748, has been discovered in the widely-used Forminator Forms WordPress plugin, potentially impacting over 600,000 websites. The flaw, rated with a CVSS score of 9.8, allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, to vulnerable servers. This capability can lead to complete site compromise through remote code execution.

The vulnerability is exploitable only on WordPress sites that utilize a form configured with both a File Upload field and a Select field. The issue arises from insufficient validation of file types within the plugin's handle_file_upload function. Specifically, the plugin's blocklist for dangerous file extensions relies on exact-key matching, which can be bypassed by using alternative MIME type keys, especially when combined with a public submission handler that trusts attacker-controlled upload field configurations injected via a forged Select field value.

Researchers at Wordfence discovered the vulnerability and reported it through their Bug Bounty Program, earning a bounty of $2,048.00. The technical analysis reveals that the set_field_data() function in the Forminator_CForm_Front_Action class processes submitted fields. When a Select field is used to forge an upload record, the process_uploads() function in the Forminator_Upload class trusts the provided field_type and field_array values, allowing an attacker to specify an executable file for upload.

Once an attacker successfully uploads a malicious PHP file, they can then execute it on the server. This allows for a range of malicious activities, from defacing the website to installing backdoors, stealing sensitive data, or using the compromised server for further attacks. The severity of this vulnerability underscores the importance of secure coding practices and thorough input validation in plugins handling file uploads.

Wordfence has confirmed that its firewall, including the free version, provides protection against exploits targeting this vulnerability through its built-in Malicious File Upload protection. The Forminator team was notified on July 14, 2026, and promptly acknowledged the report. A patched version, 1.56.2, was released on July 31, 2026, addressing the security flaw.

Users of the Forminator Forms plugin are strongly urged to update to version 1.56.2 or later immediately to mitigate the risk of exploitation. The plugin, developed by WPMU DEV, is a popular choice for creating custom forms, including those that handle file submissions, making this vulnerability a significant concern for a large segment of the WordPress ecosystem.

This incident highlights a recurring theme in WordPress security: vulnerabilities in popular plugins that handle user-submitted data can have widespread impact. The combination of specific field configurations and flawed validation logic created a critical attack vector that could have led to widespread site takeovers if not for the prompt action of the security researchers and the plugin developers.

As of the publication of this report, the vulnerability is identified as CVE-2026-15748, with an affected version range of Forminator Forms up to and including 1.56.1. The prompt patching by the Forminator team and the protection offered by security plugins like Wordfence are crucial in defending against such threats.