A critical arbitrary file upload vulnerability has been discovered in the Forminator Forms plugin for WordPress, allowing an unauthenticated attacker to upload a malicious PHP file to the server and achieve remote code execution. The vulnerability is tracked as CVE-2026-15748 with a CVSS score of 9.8 out of 10. The plugin is installed on more than 600,000 sites, and according to WordPress.org statistics, roughly half of them — around 300,000 installations — are still running vulnerable versions. A fix is available in version 1.56.2, and administrators should update immediately.
Technical details of the vulnerability
According to Wordfence research, the vulnerability was discovered by a researcher using the alias daroo and affects all versions of Forminator Forms up to and including 1.56.1. The root cause lies in the handle_file_upload() function, which does not strictly enough validate the types of uploaded files.
The protection bypass mechanism is reportedly based on two weaknesses:
- Bypassing the extension blacklist. Filtering of dangerous file extensions relies on exact key matches. However, in MIME type entries alternative values can be separated by the ‘|’ character, which makes it possible to bypass the check and upload a file with an executable extension.
- Manipulating form parameters. The public form submission handler trusts the upload field settings that come from the client side. An attacker can forge the value of a Select field and pass in their own parameters for the File Upload field, forcing the server to accept an arbitrary file.
Successful exploitation may result in the installation of a web shell, execution of arbitrary commands on the server, and complete compromise of the site.
Exploitation conditions and mitigating factors
Despite the critical CVSS score, real-world exploitability depends on the configuration of a particular site. A number of conditions must be met for a successful attack:
- The target site must have a form that contains both File Upload and Select fields at the same time. Forms without this combination of fields are not vulnerable to the attack.
- By default, uploaded files are placed in a directory protected by an .htaccess file that blocks execution of PHP scripts. This significantly reduces the risk under the standard configuration.
However, the danger increases significantly if an administrator has configured a custom directory for storing uploads via the Custom File Upload Storage feature. According to the researchers, in such a directory the protective .htaccess file may not be created, because the relevant WordPress mechanism is not available on the first request from the frontend. In this scenario, it is enough for an attacker to access the uploaded PHP file directly via its URL, and the web server will execute the malicious code.
As of the time of publication, active exploitation of the vulnerability has not been confirmed — CVE-2026-15748 is not listed in the CISA KEV catalog, and there is no information about its use in real-world attacks. Nevertheless, the ease of exploitation and the widespread use of the plugin make the appearance of exploits a matter of time.
Impact assessment
Forminator Forms is one of the most popular form builders for WordPress, used on sites of the most diverse types: from corporate portals to online stores and educational platforms. The highest risk is faced by sites that:
- have forms that accept file uploads from unauthenticated users;
- have custom upload storage configured;
- lack additional protection at the web server level (for example, Nginx rules that forbid executing PHP in upload directories).
Compromise via a web shell upload gives an attacker full control over the server, which can lead to data theft, defacement, spam distribution, hosting malware for site visitors, and using the server as a springboard for further attacks.
Recommendations
- Update immediately Forminator Forms to version 1.56.2 or later. The patch was released on July 31, 2026 and is available via the standard WordPress update mechanism.
- Check your upload storage configuration. If you are using Custom File Upload Storage, make sure the directory contains an .htaccess file (or an equivalent configuration for Nginx) that forbids execution of PHP scripts.
- Audit uploaded files. Check upload directories for suspicious PHP files, especially if forms with File Upload and Select fields were publicly accessible while vulnerable versions were in use.
- Restrict the types of files that can be uploaded at the web server level regardless of the plugin’s logic — this will provide defense in depth.
- Consider using a WAF with rules that block uploading files with executable extensions through forms.
Given that more than 300,000 sites are presumably still unpatched and exploitation does not require authentication, upgrading to Forminator Forms 1.56.2 should be a priority task for every WordPress administrator using this plugin. In parallel with the update, it is worth checking upload directories for unusual PHP files — this will help detect any compromise that may have occurred before the patch was installed.
