Critical RCE Flaw in Forminator WordPress Plugin Affects 600,000+ Sites

Key points

• Forminator Forms plugin has a critical RCE vulnerability (CVE-2026-15748).
• Unauthenticated attackers can upload malicious PHP files.
• Affects all plugin versions up to 1.56.1; patched in 1.56.2.
• Exploitation requires a form with File Upload and Select fields.
• The vulnerability has a CVSS score of 9.8.
• The flaw is an arbitrary file upload via the handle_file_upload function.
• The issue is a combination of several weaknesses.
• Attackers can forge records using the Select field.
• Attackers can take control of the field configuration passed to the upload function.
• Attackers can bypass the plugin’s blocklist of dangerous file types.
• The blocklist performs exact-key matching bypassed by pipe-alternative MIME type keys.
• A public submission handler trusts attacker-controlled upload field configuration.
• Elementor Pro WordPress plugin has a critical RCE vulnerability (CVE-2026-32475).
• Elementor Pro vulnerability affects all plugin versions up to 4.2.1.
• Elementor Pro vulnerability requires a published Elementor page with a File Upload form widget.
• Elementor Pro flaw is in the Forms module's File Upload field.
• Elementor Pro flaw involves extension check and file-move step running in separate loops.
• Elementor Pro flaw allows attackers to submit two file parts for the same field.
• Elementor Pro vulnerability is patched in version 4.2.2.
• Elementor Pro flaw involves separate loops for validation and processing.
• Elementor Pro flaw allows attackers to use an empty filename entry to bypass validation.
• GiveWP WordPress donation plugin has a critical RCE vulnerability (CVE-2026-82222).
• GiveWP vulnerability affects versions through 4.16.7.1.
• GiveWP vulnerability allows unauthenticated attackers to execute arbitrary commands.
• GiveWP vulnerability was reported by Udin Chan on July 28 via Patchstack.
• GiveWP plugin has over 100,000 installs.
• GiveWP vulnerability chains three issues: unsafe unserialization, attacker-controlled serialized objects, and a gadget chain.
• GiveWP vulnerability exploitation requires an attacker account on the target site.
• GiveWP exposes an unauthenticated registration action (give_action=user_register).
• WPMU DEV Dashboard plugin has an authentication bypass flaw (CVE-2026-76581).
• WPMU DEV Dashboard flaw affects all versions up to 5.0.1.
• WPMU DEV Dashboard flaw requires Hub Single-Sign On (SSO) enabled and mapped to an administrator.
• Avada theme has an arbitrary file write flaw (CVE-2026-18431).
• Avada theme flaw affects all versions up to 7.16.
• Avada theme flaw requires Fusion Builder plugin up to 3.16 to be installed and active.
• All-in-One WP Migration and Backup plugin has a high-severity SQL injection vulnerability (CVE-2026-19949).
• All-in-One WP Migration and Backup vulnerability affects versions through 7.109.
• All-in-One WP Migration and Backup vulnerability allows unauthenticated attackers to execute remote code.
• All-in-One WP Migration and Backup vulnerability was discovered by Jack Taylor.
• All-in-One WP Migration and Backup vulnerability was reported in mid-August through Wordfence.
• All-in-One WP Migration and Backup vulnerability is a second-order SQL injection.
• All-in-One WP Migration and Backup vulnerability involves incorrect parsing of escaped backslashes and quotation marks.
• All-in-One WP Migration and Backup vulnerability requires an administrator to export and import the site.
• All-in-One WP Migration and Backup vulnerability can expose the plugin’s secret import key (ai1wm_secret_key).
• All-in-One WP Migration and Backup plugin has 3.25 million sites remaining vulnerable.
• All-in-One WP Migration and Backup vulnerability has a CVSS score of 8.8.
• All-in-One WP Migration and Backup vulnerability is in the archive restore functionality.
• All-in-One WP Migration and Backup vulnerability involves insufficient escaping of user-supplied input.
• All-in-One WP Migration and Backup vulnerability involves insufficiently prepared SQL queries.
• All-in-One WP Migration and Backup vulnerability allows attackers to use WordPress core's trackback functionality.
• All-in-One WP Migration and Backup vulnerability allows attackers to deploy malicious plugins.
• All-in-One WP Migration and Backup plugin packages sites into .wpress archives.
• All-in-One WP Migration and Backup import operation is unauthenticated.
• All-in-One WP Migration and Backup vulnerability allows submitting two trackbacks to a public post.
• Elementor Pro vulnerability is actively exploited to upload webshells.
• Elementor Pro plugin has over 6 million active installations.
• Elementor Pro vulnerability was patched on August 19.
• Wordfence blocked almost 200,000 exploitation attempts.
• Uploaded payload is stored under /wp-content/uploads/elementor/forms/.
• Super Forms plugin has a critical RCE vulnerability (CVE-2026-14894).
• Super Forms vulnerability is a missing file type validation flaw.
• Super Forms vulnerability was fixed in version 6.3.314.
• Elementor Pro vulnerability has a CVSS score of 9.0/9.8.
• Wordfence blocked over 440,000 exploit attempts targeting Super Forms and Elementor Pro.
• Elementor Pro is a paid version of the Elementor plugin.
• Elementor Pro has a Form widget with File Upload fields.
• The vulnerability allows unauthenticated attackers to upload arbitrary PHP files.
• The validation loop encounters an upload slot marked as empty, triggering an error and returning.
• The vulnerability results in checks never being applied to remaining files uploaded through the same form field.
• An attacker can submit an upload field as an array with an empty slot and a PHP payload.
• WooCommerce Wholesale Lead Capture plugin has a critical RCE vulnerability (CVE-2026-27540).
• WooCommerce Wholesale Lead Capture vulnerability affects over 6,000 active installations.
• Wordfence blocked over 100,000 exploit attempts targeting WooCommerce Wholesale Lead Capture since June 2026.
• WooCommerce Wholesale Lead Capture vulnerability is an arbitrary file upload due to missing file type validation.
• WooCommerce Wholesale Lead Capture vulnerability is in the AJAX action "wwlc_file_upload_handler".
• WooCommerce Wholesale Lead Capture vulnerability affects all versions up to, and including, 2.0.3.1.
• Attackers submit crafted requests to "wwlc_file_upload_handler" with a forged file_settings parameter.
• Attackers upload a malicious PHP file named "shell.php".
• WordPress 7.1.2 patches an unauthenticated path traversal vulnerability.
• The vulnerability allows including arbitrary local PHP files.
• RCE is possible under specific server and theme configurations.
• The flaw affects legacy Twenty Twelve and Twenty Fourteen themes.
• The flaw affects popular third-party themes like Neve, Hestia, and Sydney.
• The fix has been backported to all WordPress branches back to 4.7.
• The vulnerability is in get_page_template() page-template resolution.
• WordPress core has a critical vulnerability (CVE-2026-87902).
• WordPress core vulnerability allows unauthenticated attackers to load arbitrary PHP files.
• WordPress core vulnerability affects versions 4.7.0 through 7.1.1.
• WordPress core vulnerability has a CVSS score of 9.2.
• WordPress core vulnerability was fixed on September 22.
• WordPress core vulnerability fix was backported to version 4.7.37.
• Attackers are exploiting CVE-2026-87902 to write files and execute shell commands.
• Initial attack traffic for CVE-2026-87902 started less than five hours after the patch release.
• Malicious activity for CVE-2026-87902 increased tenfold.
• Patchstack observed the first malicious requests for CVE-2026-87902 at 17:44 UTC on September 22.
• Robert Ressl discovered CVE-2026-87902.
• Exploitation requires the active theme to contain a top-level directory starting with 'page-'.
• Exploitation requires a chosen local .php target file to exist and be readable by the web server account.
• Previdian observed exploitation attempts from IP address 104.194.9.227 in New Jersey.
• The pearcmd.php PEAR->RCE transition can be used when register_argc_argv is On.
• The official PHP image for Docker is affected by the vulnerability.
• The default cPanel configuration is affected when PHP prior to 8.5 is in use.
• Elementor plugin has a CSRF vulnerability.
• Elementor CSRF vulnerability affects versions 4.3.0 and 4.3.1.
• Elementor CSRF vulnerability allows unauthenticated attackers to create administrator accounts.
• Elementor CSRF vulnerability affects up to 2 million websites.
• Elementor CSRF vulnerability was patched in version 4.3.2.
• Elementor CSRF vulnerability was reported by Saggre to Patchstack.
• Elementor CSRF vulnerability was reported on September 22.
• Elementor released a fix two days after the report.
• Elementor CSRF flaw is in the Editor Events module.
• Elementor Website Builder is active on 10 million websites.
• Elementor CSRF vulnerability has a CVSS score of 8.8.
• Elementor CSRF vulnerability allows attackers to create a second administrator account.
• Elementor CSRF vulnerability does not require JavaScript, a submitted form, or a web page under attacker control.
• Elementor CSRF vulnerability link can be a plain anchor tag in an email, chat message, or comment.