A critical vulnerability in Forminator Forms, one of the most widely used WordPress form-builder plugins with over 600,000 active installations, can be exploited by anyone on the internet — no account required — to run arbitrary code on a vulnerable site and seize full control of it.
The flaw, CVE-2026-15748 (CVSS 9.8), lives in the plugin’s file upload handler. Security company Wordfence discovered that the function responsible for processing uploaded files uses a blocklist approach to reject dangerous file types, but that blocklist can be bypassed using an alternative MIME type key format. An attacker who finds a WordPress form containing both a File Upload field and a Select field can manipulate the form submission to upload a custom PHP file, then trigger its execution by requesting it directly from the server — instantly gaining the ability to run any command on the host. All versions of Forminator Forms up to and including 1.56.1 are affected; the fix is in version 1.56.2, released on July 31, 2026.
One partial protection: in the default configuration, uploaded files land in a directory guarded by a .htaccess rule that blocks PHP execution. However, if a site administrator has configured a custom file storage location, that safeguard is absent — making those sites immediately exploitable without any additional steps.
How to check if you’re affected
Affected versions include all releases of Forminator Forms at or below version 1.56.1. In your WordPress dashboard, navigate to Plugins → Installed Plugins and look for “Forminator” in the list. If the version shown is 1.56.1 or earlier, update to 1.56.2 right away. If you use managed WordPress hosting, check whether your host has already applied the update automatically. Site owners running forms with file upload capability should treat this as highest priority.
Separately, Wordfence also disclosed a critical authentication bypass in the User Profile Builder plugin (CVE-2026-15826, CVSS 9.8), affecting all versions before 3.16.5. That flaw lets an unauthenticated attacker sign in as the site’s administrator account. Check that plugin for updates as well.
Sources
- The Hacker News — Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
- Wordfence security research (original advisory)