As reported by The Hacker News, a critical-severity vulnerability in the Forminator Forms WordPress plugin — tracked as CVE-2026-15748 with a CVSS score of 9.8 — exposes more than 600,000 active installations to unauthenticated remote code execution. The flaw was patched in version 1.56.2, released July 31, 2026, but the large install base and the severity of impact make this a priority remediation item for any organization running WordPress.
Vulnerability Summary
| CVE ID | CVE-2026-15748 |
| CVSS Score | 9.8 (Critical) |
| Affected Product | Forminator Forms (WordPress plugin) |
| Affected Versions | All versions <= 1.56.1 |
| Patched Version | 1.56.2 (July 31, 2026) |
| Attack Type | Unauthenticated arbitrary file upload leading to RCE |
| Prerequisites | Form must contain both a File Upload field and a Select field |
| Active Exploitation | No confirmed in-the-wild exploitation reported at time of disclosure |
Why This Matters Beyond the CVSS Number
What makes CVE-2026-15748 particularly dangerous is the convergence of two design weaknesses that individually might seem minor. The first is a blocklist-based file extension validation in the handle_file_upload() function that relies on exact-key matching — a pattern that is trivially bypassed using pipe-alternative MIME type keys. The second is a public submission handler that trusts attacker-controlled upload field configuration injected through a forged Select field value.
Blocklist-based validation is a recurring failure pattern in WordPress plugin security. When the validation logic trusts client-controlled configuration to define what's acceptable, the blocklist becomes an attacker-controlled allowlist in practice.
The default storage path includes an .htaccess file that blocks PHP execution — a meaningful but insufficient mitigation. The problem emerges when administrators configure a Custom File Upload Storage root. In that scenario, the protective .htaccess is only created when first needed during a frontend request, and the WordPress helper responsible for writing it is not loaded at that point. This means the very first upload to a custom storage root lands in a directory with no PHP execution restriction, and simply requesting the file triggers code execution.
Who Is Most Exposed
- Marketing and content sites that use Forminator for lead capture forms with file attachments — the exact use case the plugin is designed for.
- Organizations with custom upload storage paths configured for organizational or compliance reasons, where the
.htaccesssafeguard is absent. - Managed WordPress hosting environments where multiple sites share infrastructure — a single compromised site can become a pivot point.
- E-commerce and membership sites where form-based file uploads are part of onboarding or support workflows.
Broader Implications
This vulnerability reinforces a structural problem in the WordPress ecosystem: plugins with hundreds of thousands of installations can ship critical validation flaws that persist for years. The reliance on blocklist-based file validation rather than strict allowlisting is a pattern that defenders should audit across their entire plugin stack, not just Forminator. The secondary auth bypass disclosed in User Profile Builder (40,000+ installations) further underscores that form and profile plugins remain a consistent attack surface.
Shield53 Recommendations
Immediate Actions:
- Patch now: Update Forminator Forms to version 1.56.2 or later immediately. Verify the update applied successfully by checking the plugin version in the WordPress admin dashboard.
- Audit form configurations: Identify any Forminator forms that include both a File Upload field and a Select field. These are the specific attack surface for this CVE. If any are unused or non-essential, remove them.
- Review custom storage paths: If you configured a Custom File Upload Storage root, verify that an
.htaccessfile exists in that directory and includes PHP execution restrictions. If missing, manually create one withphp_flag engine offor equivalent directives for your web server. - Inspect for compromise: Check upload directories for unexpected
.phpfiles, particularly in custom storage roots. Review web server access logs for POST requests to Forminator AJAX endpoints followed by GET requests to.phpfiles in upload directories. - Implement WAF rules: Deploy virtual patching rules that inspect Forminator form submissions for pipe-alternative MIME type patterns in file upload fields. This provides interim protection for sites where immediate patching is delayed.
Hardening Beyond This CVE:
- Disable PHP execution in all upload directories at the web server configuration level, not just via
.htaccess. - Constrain file upload fields to strict allowlists of extensions and MIME types rather than relying on plugin blocklists.
- Implement file content inspection (magic bytes validation) rather than trusting extension or MIME type headers alone.
- Run regular plugin vulnerability scans across your WordPress portfolio — tools like WPScan or commercial equivalents can flag known CVEs before they become incidents.
