A significant security flaw has been identified in the Forminator Forms plugin, a popular tool used on WordPress websites. This vulnerability, classified as CVE-2026-15748 with a critical CVSS score of 9.8, could potentially allow unauthorized users to execute remote code on affected websites, according to cybersecurity firm Defiant.
Understanding the Vulnerability
The flaw is rooted in the handle_file_upload function of the Forminator Forms plugin. This function’s inadequate validation of file types permits attackers to upload malicious executable files. By exploiting this weakness, hackers can manipulate the plugin’s Select field configuration, bypassing the blocklist of file types intended to prevent such breaches.
Defiant describes the issue as a culmination of several security gaps. Attackers can inject their own configuration values through a forged Select field, allowing them to upload harmful files that evade detection by the plugin’s security measures.
Risk and Impact Assessment
In default settings, uploaded files are stored in a directory that blocks PHP execution, providing some protection. However, if a Custom File Upload Storage root is set up, this safeguard is bypassed, and the uploaded PHP code can be executed upon direct request. Such vulnerabilities can lead to complete website takeover through tactics like webshell deployment.
The vulnerability affects all versions of Forminator Forms up to 1.56.1, with a fix issued in version 1.56.2 on July 31. The plugin boasts over 600,000 installations, with approximately half of these running the susceptible version, thereby putting over 300,000 websites at risk.
Preventive Measures and Future Outlook
Despite the absence of any known exploitation of this vulnerability in live attacks, website administrators are strongly advised to update to the latest patched version to safeguard their sites. Regular updates and vigilant monitoring of plugins are crucial steps in preventing similar threats.
This incident underscores the importance of maintaining updated cybersecurity measures and being proactive with software updates. As vulnerabilities are identified and patched, prompt action is necessary to protect digital assets from potential threats.
