Forminator Flaw Exposes 300,000 WordPress Sites to Remote Code Execution
A critical vulnerability in the Forminator Forms plugin for WordPress is leaving more than 300,000 websites exposed to remote code execution (RCE) attacks. Tracked as CVE-2026-15748 with a CVSS score of 9.8, the flaw was disclosed by WordPress security firm Defiant and resides in the plugin's handle_file_upload function, where insufficient file type validation allows unauthenticated attackers to upload executable files to the server. Forminator Forms has over 600,000 active installations, and WordPress data indicates roughly half are running a vulnerable version.
The bug stems from a combination of weaknesses that enable attackers to forge records using a form's Select field, seize control of the field configuration passed to the upload function, and bypass the plugin's blocklist of dangerous file extensions. According to Defiant, the dangerous-extension blocklist relies on exact-key matching, which is circumvented through pipe-alternative MIME type keys. A public submission handler that trusts attacker-controlled upload field configuration—delivered via a forged Select field value—completes the exploit chain. Site administrators can use a port scanner to identify exposed services that could be leveraged in follow-on attacks.
In default configurations, uploaded files are placed in a protected directory that prevents PHP execution. However, when administrators have configured a Custom File Upload Storage root, that protection does not extend to the alternate location, and any attacker-supplied PHP code is executed as soon as the uploaded file is requested. "This is due to insufficient file type validation in handle_file_upload... combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value," Defiant explained. As with all arbitrary file upload vulnerabilities, the path leads to complete site compromise through webshells and other post-exploitation techniques.
The vulnerability affects all Forminator Forms versions up to and including 1.56.1 and was patched in version 1.56.2, released on July 31. There are currently no confirmed reports of in-the-wild exploitation, but the severity score and ease of exploitation make rapid patching essential. Administrators should also verify the integrity of any custom upload directories and confirm their domain's TLS posture with an SSL/TLS checker, while a WHOIS lookup can help teams audit ownership records for any newly registered attacker infrastructure targeting their site.