Critical Forminator WordPress Flaw Enables Unauthenticated RCE (CVSS 9.8)
A critical security vulnerability has been disclosed in the Forminator Forms WordPress plugin, exposing more than 600,000 active installations to remote code execution attacks. Tracked as CVE-2026-15748, the flaw carries a near-maximum CVSS score of 9.8 out of 10.0 and was discovered and reported by a security researcher using the alias "daroo." The vulnerability affects all plugin versions up to and including 1.56.1, with a fix shipped in version 1.56.2 on July 31, 2026. Site administrators are strongly urged to update immediately or use a tool like our privacy checkup to assess whether their WordPress installation may be exposed.
According to Wordfence, the bug resides in the "handle_file_upload()" function and stems from insufficient file type validation on user-supplied input. Specifically, the dangerous-extension blocklist relies on exact-key matching that can be bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. If a form containing both a File Upload field and a Select field is present on the target site, an unauthenticated attacker can submit the form and upload a specially crafted PHP file directly to the server, achieving complete site compromise. Running an SSL/TLS checker ensures the underlying transport is hardened, but it cannot mitigate this application-layer flaw.
In its default configuration, files are stored in a directory protected by an .htaccess file that blocks PHP execution. However, when administrators configure a Custom File Upload Storage root, that safeguard disappears because the .htaccess file is created lazily during the first request, leaving the upload directory unprotected at the moment of exploitation. Merely requesting the uploaded file is enough to cause the web server to execute the attacker-controlled PHP code. Wordfence recommends scanning external-facing services with a port scanner to verify that no unintended services have been spawned as part of a post-exploitation chain.
The Forminator disclosure follows closely on the heels of another Wordfence report covering a critical authentication bypass in User Profile Builder, tracked as CVE-2026-15826 and also rated 9.8. That vulnerability, affecting version 3.16.4 and earlier, allows unauthenticated attackers to log in as the user with ID 1, typically the site administrator, and fully take over affected sites running on more than 40,000 active WordPress installations. It was patched on July 16, 2026, with the release of version 3.16.5. Both flaws underscore the high impact of missing input validation and weak authentication safeguards in widely deployed WordPress plugins, and serve as a reminder that administrators should enable automatic updates and maintain an external attack surface inventory to detect misconfigurations promptly.