A significant security vulnerability has been identified in the Forminator Forms plugin for WordPress, which is currently active on over 600,000 websites. This flaw, if exploited, can lead to unauthorized code execution, posing a substantial threat to affected sites.
Details of the Forminator Vulnerability
The vulnerability has been cataloged as CVE-2026-15748 and boasts a high CVSS score of 9.8 out of 10. An online security researcher known as ‘daroo’ is credited with the discovery and report of this critical flaw. According to Wordfence, the security company that published the findings, attackers could exploit this vulnerability to upload arbitrary files, including PHP executables, to a compromised site.
Successful exploitation requires the presence of a form with both a File Upload and a Select field on the WordPress site. The vulnerability affects all plugin versions up to 1.56.1, with a fix released in version 1.56.2 on July 31, 2026.
Technical Analysis and Exploitation
The core of the vulnerability lies in the ‘handle_file_upload()’ function, where inadequate file type validation allows unauthorized file uploads. Attackers can utilize this loophole to upload malicious PHP files by submitting forms configured with specific parameters, thereby gaining site control.
While the default setup includes an .htaccess file to prevent PHP execution in the upload directory, custom configurations may lack this protection. If a site administrator has modified the File Upload Storage root, the preventative measure might be absent, allowing execution of the uploaded PHP code.
Additional Security Concerns
In related news, Wordfence also uncovered an authentication bypass vulnerability in the User Profile Builder plugin, affecting over 40,000 installations. This flaw, CVE-2026-15826, allows attackers to log in as the administrator, posing a severe risk to site security. The vulnerability was patched on July 16, 2026, with the deployment of version 3.16.5.
This issue arises from the misuse of the ‘wppb_log_in_user()’ function, which mishandles user registration processes. Specifically, the WordPress system fails to properly handle certain registration errors, inadvertently granting unauthorized access to the main administrator account.
Website administrators are urged to promptly update both plugins to mitigate potential risks and ensure their WordPress installations are secure against these vulnerabilities.
