● Covered by 1 source · 1 reportMedium impact1 negative
Critical RCE Flaw in Forminator WordPress Plugin Affects 600,000+ Sites
Key points
- Forminator Forms plugin has a critical RCE vulnerability (CVE-2026-15748).
- Unauthenticated attackers can upload malicious PHP files.
- Affects all plugin versions up to 1.56.1; patched in 1.56.2.
- Exploitation requires a form with File Upload and Select fields.
Critical Vulnerability Discovered
A critical security flaw, tracked as CVE-2026-15748, has been identified in the Forminator Forms WordPress plugin. This vulnerability, rated 9.8 out of 10.0 on the CVSS scoring system, could allow unauthenticated attackers to achieve arbitrary code execution on affected websites. The plugin is actively installed on over 600,000 WordPress sites.
Mechanism of Exploitation
The flaw stems from insufficient file type validation within the "handle_file_upload()" function, enabling attackers to upload arbitrary files, including executable PHP files. For successful exploitation, a site must have a form containing both a File Upload field and a Select field. Attackers can bypass the dangerous-extension blocklist by using pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configurations injected via a forged Select field value.
Impact and Remediation
Upon successful exploitation, an attacker can upload a specially crafted PHP file and achieve remote code execution, potentially leading to complete site compromise. While the default configuration uploads files to a directory protected by an .htaccess file preventing PHP execution, sites with a Custom File Upload Storage root may lack this safeguard. The vulnerability impacts all versions of the plugin up to and including 1.56.1 and has been addressed in version 1.56.2, released on July 31, 2026. Users are advised to update their plugins immediately.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A critical security vulnerability (CVE-2026-15748) in the Forminator Forms WordPress plugin allows unauthenticated attackers to upload malicious PHP files, leading to remote code execution and site compromise. The flaw, rated 9.8 on CVSS, affects over 600,000 active installations and requires specific form configurations for exploitation, but has been patched in version 1.56.2.