CVE-2026-15748: Critical Forminator WordPress Flaw Enables Unauthenticated RCE

A critical security vulnerability in the popular Forminator Forms plugin for WordPress can allow unauthenticated attackers to upload executable PHP files and potentially take complete control of vulnerable websites. Tracked as CVE-2026-15748, the arbitrary file upload flaw carries a CVSS score of 9.8 and affects Forminator versions up to and including 1.56.1.

Forminator is a widely deployed drag-and-drop form builder used for contact forms, payment forms, polls, quizzes, and file uploads. The plugin has more than 600,000 active installations. SecurityWeek estimated that over 300,000 sites were still running vulnerable releases when the issue was publicly disclosed, creating a significant potential attack surface.

The vulnerability is particularly dangerous because exploitation requires no authentication or user interaction. Under the required form configuration, an attacker can manipulate Forminator’s submission handling, bypass restrictions on dangerous file types, and upload PHP code to the web server. If the uploaded file can execute, the attack can progress directly to remote code execution and complete WordPress site compromise.

CVE-2026-15748 analysis

The vulnerability originates in Forminator’s handle_file_upload() functionality and results from a combination of insufficient file type validation and unsafe handling of attacker-controlled form configuration data. Rather than relying on a single validation failure, an attacker chains several weaknesses in the form submission process to transform ordinary user-controlled data into a forged upload configuration.

Successful exploitation requires a published Forminator form containing both a File Upload field and a Select field. Wordfence found that a Select field can be abused as a carrier for specially crafted nested data because Forminator’s generic request sanitizer allows certain nested values to reach later processing stages.

An attacker can manipulate this data so the Select field effectively masquerades as an Upload record. The forged record can include attacker-controlled values defining the field name, type, and configuration. When the form also contains a genuine File Upload field, Forminator’s upload-processing routine operates on the forged entry and passes the attacker-supplied configuration to the upload handler as though it were legitimate.

The second part of the exploit targets Forminator’s dangerous-extension blocklist. The plugin attempts to remove file types such as PHP, JavaScript, executable files, shell scripts, and other potentially dangerous formats. However, the vulnerable implementation performs exact-key matching.

Wordfence demonstrated that an attacker can provide an alternative extension and MIME type expression that is not recognized by the blocklist but is still interpreted by WordPress as matching a .php file. This allows an executable PHP payload to pass the vulnerable file validation process and be written to the server.

CVE-2026-15748 affects every Forminator Forms release up to and including version 1.56.1. The issue is categorized as CWE-434, Unrestricted Upload of File with Dangerous Type, and its CVSS vector reflects network-based exploitation with low complexity, no privileges, no user interaction, and potentially high impact to confidentiality, integrity, and availability.

There is an additional condition that determines whether arbitrary file upload can immediately become remote code execution. In Forminator’s default configuration, uploaded files are stored in a directory containing an .htaccess file designed to prevent PHP execution.

However, administrators can configure a Custom File Upload Storage root. Wordfence found that this custom directory may be created without the same .htaccess protection because it can first be initialized during a frontend request where the WordPress helper responsible for creating the protection file is unavailable. In that configuration, simply requesting the malicious uploaded PHP file can cause the web server to execute the attacker’s code.

The most important details for CVE-2026-15748 therefore involve both the vulnerable form design and the upload-storage configuration. A site with the affected plugin is not automatically exploitable through the demonstrated RCE chain unless the required File Upload and Select fields are present, while custom upload storage can significantly increase the consequences of successful file upload.

Once PHP execution is obtained, an attacker could deploy a web shell and use it to take control of the WordPress installation. Depending on server privileges and hosting architecture, this could enable modification of site content, credential theft, database access, malware distribution, creation of administrator accounts, persistence, or further movement into the underlying hosting environment. Wordfence specifically warns that arbitrary file upload vulnerabilities of this type can lead to complete site compromise.

The vulnerability was discovered by security researcher daroo and reported through the Wordfence Bug Bounty Program. Wordfence received the initial submission on July 11, 2026, validated the issue and confirmed the CVE-2026-15748 PoC on July 14, and provided full technical details to the Forminator development team the same day.

The developer acknowledged the vulnerability on July 20 and submitted a patch for review. Forminator version 1.56.2, containing the complete security fix, was released on July 31, 2026. The vulnerability was publicly detailed by Wordfence in mid-August.

At the time of disclosure, there were no reports of active exploitation in the wild. CISA’s vulnerability enrichment information also listed exploitation as “none” as of August 18, although it classified exploitation as automatable and the potential technical impact as total.

There are currently no campaign-specific CVE-2026-15748 IOCs such as attacker-controlled IP addresses, domains, or malware hashes published in the cited research. Organizations should therefore focus on behavioral evidence, suspicious uploads, PHP files appearing in upload directories, and unexpected server-side execution rather than relying solely on static indicators.

CVE-2026-15748 Mitigation

Website administrators should immediately upgrade Forminator Forms to version 1.56.2 or later. The patched release was published on July 31, 2026, and fully addresses the arbitrary file upload weakness described by Wordfence.

CVE-2026-15748 detection should start with identifying WordPress installations running Forminator and determining their exact plugin version. Sites using version 1.56.1 or earlier should be treated as vulnerable and prioritized for patching, particularly if public forms include both Select and File Upload fields.

Administrators should also inspect Forminator’s file-storage configuration. Sites using a custom upload root deserve additional attention because the directory may not contain the .htaccess protection that normally prevents uploaded PHP files from executing.

To Detect CVE-2026-15748 exploitation attempts, security teams should review WordPress, web server, WAF, and file-system telemetry for activity such as:

• Unexpected .php, .phtml, or other executable files in Forminator upload directories
• Form submissions containing unusual nested data associated with Select fields
• Suspicious MIME type or extension patterns submitted to file upload functionality
• Direct HTTP requests to recently uploaded PHP files
• New or modified WordPress administrator accounts following suspicious form submissions
• Unexpected outbound connections initiated by the PHP or web server process
• Web shells, obfuscated PHP code, or unfamiliar files appearing under WordPress content directories
• Unexplained modifications to themes, plugins, configuration files, or database records

Because these behaviors can have legitimate or unrelated causes, they should be correlated with Forminator version information and suspicious form-submission activity before being treated as confirmation of compromise.

Organizations should also review historical logs from before the update. Installing version 1.56.2 prevents future exploitation but does not remove malicious files or persistence mechanisms that may already have been placed on the server.

If evidence of exploitation is discovered, incident responders should preserve web and application logs, identify uploaded payloads, inspect the filesystem for web shells and persistence, review administrator accounts and API credentials, rotate exposed WordPress and database secrets, and verify the integrity of core WordPress, plugin, and theme files.

Wordfence states that its firewall’s built-in malicious file upload protection blocks attempts targeting this vulnerability for both paid and free users. However, a web application firewall should be considered an additional defensive layer rather than a substitute for updating the vulnerable plugin.

Considering the vulnerability’s 9.8 severity, lack of authentication requirements, potentially automatable exploitation, and the large number of installations, CVE-2026-15748 mitigation should be treated as a high-priority action for organizations operating internet-facing WordPress websites.

Contact Sales