Security researchers at Wordfence have disclosed a critical security vulnerability in Forminator Forms, a popular WordPress form-building plugin with more than 600,000 active installations.
The flaw, tracked as CVE-2026-15748, received a CVSS severity score of 9.8 out of 10. Wordfence disclosed the vulnerability to the Forminator development team in July, and a fully patched version, 1.56.2, was later released.
Attackers Could Upload Malicious Files
The vulnerability could allow an unauthenticated attacker, meaning someone who does not need a WordPress account or password, to upload files that would normally be blocked by the plugin.
Under certain server configurations, an attacker could potentially upload and execute malicious PHP files. This could lead to remote code execution and, in the most serious cases, give an attacker control of the affected website.
However, not every site using Forminator is vulnerable to exploitation, requiring a published form with both a File Upload field and a Select field. Technical analysis also notes that default upload protections can prevent uploaded PHP files from executing in some configurations.
Site administrators using the plugin should check their installations and update to the latest version if they have not already done so.
Wordfence’s free and paid firewall products include protection against attempts to exploit the vulnerability.
The disclosure is another reminder of the importance of keeping WordPress plugins updated, particularly plugins that accept file uploads or other information directly from website visitors.
Leave a Reply