A severe security vulnerability identified in the Forminator Forms plugin for WordPress has put upwards of 600,000 websites at risk of unauthorized file uploads and potential site takeovers.
Details of the Security Flaw
The vulnerability, known as CVE-2026-15748, impacts versions 1.56.1 and earlier of Forminator Forms, earning a critical CVSS score of 9.8. This drag-and-drop plugin is widely utilized for creating various forms, including contact and payment forms, making the flaw particularly concerning.
With the potential for attackers to upload malicious PHP files, site administrators who haven’t implemented the latest updates are urged to act swiftly to secure their platforms.
Discovery and Response
Security researcher daroo, through the Wordfence bug bounty program, initially reported the vulnerability. Following swift validation on July 14, 2026, Wordfence coordinated with the Forminator development team to address the issue, leading to the release of a patched version, 1.56.2, on July 31, 2026.
The flaw allows attackers to manipulate the file-upload configuration of vulnerable forms, bypassing security measures designed to block dangerous file types.
Technical Exploitation and Risks
By exploiting Forminator’s file-upload system, attackers can inject a fake upload configuration, tricking the plugin into treating malicious files as legitimate uploads. This bypasses the plugin’s blocklist, which uses exact matches for file extensions, by deploying obscure patterns like ph(p) instead of php, which WordPress still recognizes as executable.
Files uploaded in this manner can be placed in directories lacking .htaccess protection, allowing attackers to execute arbitrary commands, potentially leading to remote code execution or complete site compromise.
Site administrators are advised to update to version 1.56.2 immediately and review form setups and upload directories to ensure no malicious PHP files are present and executable.
By taking these steps, administrators can safeguard their sites against potential threats posed by this critical vulnerability.
