Critical Arbitrary File Upload Vulnerability in Forminator Forms Affects 600,000 WordPress Sites

A critical security vulnerability, tracked as CVE-2026-15748, has been discovered in the widely-used Forminator Forms WordPress plugin, potentially impacting over 600,000 websites. The flaw, rated with a CVSS score of 9.8, allows unauthenticated attackers to upload arbitrary files, including malicious PHP scripts, to vulnerable servers. This capability can lead to complete site compromise through remote code execution.

The vulnerability is exploitable only on WordPress sites that utilize a form configured with both a File Upload field and a Select field. The issue arises from insufficient validation of file types within the plugin's handle_file_upload function. Specifically, the plugin's blocklist for dangerous file extensions relies on exact-key matching, which can be bypassed by using alternative MIME type keys, especially when combined with a public submission handler that trusts attacker-controlled upload field configurations injected via a forged Select field value.

Researchers at Wordfence discovered the vulnerability and reported it through their Bug Bounty Program, earning a bounty of $2,048.00. The technical analysis reveals that the set_field_data() function in the Forminator_CForm_Front_Action class processes submitted fields. When a Select field is used to forge an upload record, the process_uploads() function in the Forminator_Upload class trusts the provided field_type and field_array values, allowing an attacker to specify an executable file for upload.

Once an attacker successfully uploads a malicious PHP file, they can then execute it on the server. This allows for a range of malicious activities, from defacing the website to installing backdoors, stealing sensitive data, or using the compromised server for further attacks. The severity of this vulnerability underscores the importance of secure coding practices and thorough input validation in plugins handling file uploads.

Wordfence has confirmed that its firewall, including the free version, provides protection against exploits targeting this vulnerability through its built-in Malicious File Upload protection. The Forminator team was notified on July 14, 2026, and promptly acknowledged the report. A patched version, 1.56.2, was released on July 31, 2026, addressing the security flaw.

Users of the Forminator Forms plugin are strongly urged to update to version 1.56.2 or later immediately to mitigate the risk of exploitation. The plugin, developed by WPMU DEV, is a popular choice for creating custom forms, including those that handle file submissions, making this vulnerability a significant concern for a large segment of the WordPress ecosystem.

This incident highlights a recurring theme in WordPress security: vulnerabilities in popular plugins that handle user-submitted data can have widespread impact. The combination of specific field configurations and flawed validation logic created a critical attack vector that could have led to widespread site takeovers if not for the prompt action of the security researchers and the plugin developers.

As of the publication of this report, the vulnerability is identified as CVE-2026-15748, with an affected version range of Forminator Forms up to and including 1.56.1. The prompt patching by the Forminator team and the protection offered by security plugins like Wordfence are crucial in defending against such threats.

The Hacker News article provides additional technical details regarding the exploitation of CVE-2026-15748 in the Forminator Forms plugin. It clarifies that exploitation requires a form with both a File Upload and a Select field, and explains how a crafted Select field value can inject attacker-controlled upload field configurations. Furthermore, it details how custom file upload storage configurations, which may omit the .htaccess safeguard, can lead to direct PHP code execution upon file access.

This new report details the specific technical mechanism used to exploit the vulnerability, including how attackers can bypass the plugin's file-extension filtering by using a pattern like 'ph(p)' instead of 'php'. It also highlights that sites using custom file-upload storage locations may not have the usual protection against PHP execution, increasing the risk of remote code execution.

This new report specifies that the arbitrary file upload vulnerability, CVE-2026-15748, is due to insufficient file type validation within the handle_file_upload function. Attackers can bypass the plugin's blocklist by exploiting a combination of weaknesses, including forging records via the Select field and using pipe-alternative MIME type keys. While default configurations protect against PHP execution, custom file upload storage roots remain vulnerable, potentially leading to complete site compromise.