A critical security vulnerability has been identified in the Forminator Forms plugin for WordPress, which boasts over 600,000 active installations. This flaw, designated as CVE-2026-15748, carries a CVSS severity score of 9.8 out of 10, indicating its high risk. The vulnerability enables unauthenticated attackers to upload arbitrary files, including executable PHP scripts, potentially leading to remote code execution and complete site compromise.
The issue resides in the plugin’s ‘handle_file_upload()’ function, where insufficient validation of user-supplied input allows for the upload of files with dangerous extensions. Specifically, the vulnerability arises from the function’s inadequate file type validation, which can be bypassed using certain MIME type keys. This flaw affects all versions of Forminator up to and including 1.56.1. The developers have addressed the issue in version 1.56.2, released on July 31, 2026.
Exploitation of this vulnerability requires the presence of a form on the website that includes both a File Upload field and a Select field. In the default configuration, uploaded files are stored in a directory protected by an .htaccess file that prevents PHP execution. However, if a site administrator has configured a custom file upload storage root without similar protections, the uploaded PHP files can be executed, leading to potential site takeover.
This discovery underscores the importance of regular updates and vigilant security practices for WordPress site administrators. Given the widespread use of the Forminator plugin, the potential impact of this vulnerability is significant. Site owners are strongly advised to update to version 1.56.2 immediately to mitigate the risk. Additionally, reviewing and securing file upload configurations can provide an extra layer of defense against such vulnerabilities.
