CVE-2026-15748: Forminator's CVSS 9.8 Flaw Puts 600,000 WordPress Sites at Risk

Forminator Forms — the drag-and-drop contact, payment, and survey form builder by WPMU DEV — carries a critical unauthenticated remote code execution flaw. CVE-2026-15748 scores a 9.8 on the CVSS 3.1 scale (vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning it requires no authentication, no privileges, and no victim interaction. If your site runs Forminator 1.56.1 or earlier and has even one form combining a File Upload field with a Select field, a visitor with a web browser can turn that form into a shell.

What Broke — and How

The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type, and the root cause lives in the plugin's handle_file_upload() function. Forminator maintains a blocklist of forbidden file extensions, but the check uses exact-key matching on the MIME type map. An attacker can bypass it by injecting a pipe-alternative MIME type key — for example, application/x-php| instead of the standard key — causing the blocklist lookup to miss entirely and allowing a .php file through.

That bypass alone would be bad. What pushes this to pre-auth RCE is the second ingredient: Forminator's public AJAX submission handler trusts attacker-controlled upload field configuration injected via a forged Select field value. A visitor can craft a multipart POST request that dictates their own upload rules, then delivers an executable PHP file to a web-reachable directory. No account. No session. No CSRF token required from an authenticated user. Wordfence, who discovered and reported the flaw, confirmed this chain as fully exploitable.

The Configuration Caveat — and Why It Doesn't Protect You

The exploit requires a form that contains both a File Upload field and a Select field. This sounds like a meaningful constraint, but in practice it filters out very little. Lead capture forms, job application pages, support-ticket submissions, and client intake forms routinely include both of these field types. Forminator generates identifiable HTML markup, so attackers can enumerate a site's forms in seconds, identify the vulnerable combination, and fire the payload without ever being slowed by authentication.

Sites with custom upload storage roots that lack .htaccess protection — blocking PHP execution inside upload directories — face elevated risk even after the malicious file lands. On default WordPress configurations, those directories should already block execution, but non-standard hosting setups are common enough that auditing is warranted.

Forminator Has Been Here Before

What makes CVE-2026-15748 particularly striking is that this is the second critical arbitrary file upload in Forminator's history. In 2023, CVE-2023-4596 was structurally nearly identical — same plugin, same CWE-434 classification, same pre-auth arbitrary upload impact, patched in version 1.25.0. The plugin has now accumulated 42 recorded security vulnerabilities. Two critical instances of the same fundamental flaw class, three years apart, suggests the underlying file-handling architecture would benefit from a structural redesign rather than another blocklist patch.

Scope and Timeline

Forminator Forms has more than 600,000 active installations across the WordPress ecosystem, making it one of the more widely deployed plugins in this severity tier. The patch — version 1.56.2 — was released on July 31, 2026, following responsible disclosure by Wordfence. The CVE was made public on August 17–18, 2026, meaning roughly three weeks passed between fix availability and public disclosure. That coordinated window is standard practice and gives site administrators time to patch before exploit code proliferates.

At the time of writing, there is no confirmed in-the-wild exploitation. That window, historically, tends to close fast when a CVSS 9.8 flaw with a well-documented attack chain goes public. Do not treat the absence of confirmed exploitation as permission to delay patching.

What to Do Right Now

• Update immediately. Go to WordPress Admin → Plugins → Installed Plugins and update Forminator Forms to version 1.56.2. This is a one-click update in most installs.
• Audit your forms. Log into Forminator's form list and identify every form that combines a File Upload field with a Select field. If the form genuinely needs both, keep them — but know those forms were the vulnerable attack surface.
• Inspect upload directories. Check wp-content/uploads/forminator/ (and any custom upload root you've configured) for unexpected .php files. Any PHP file in an upload directory is almost certainly a webshell planted before you patched.
• Confirm execution blocking. Your upload directories should have an .htaccess rule denying PHP execution. Example: deny from all combined with a php_flag engine off directive. This is defense-in-depth — it won't prevent the upload, but it prevents the uploaded file from running.
• Update firewall rules. If you run Wordfence, Cloudflare WAF, Sucuri, or a similar tool, verify that rulesets have been refreshed. Wordfence began shipping rules for this flaw alongside the disclosure.

The Recurring Lesson About File Uploads

File upload functionality is one of the most reliably dangerous surfaces in a web application. The pattern repeats across plugins, frameworks, and languages: a blocklist that misses an edge case, a handler that trusts too much of the request, and suddenly a contact form becomes an entry point. If your site does not genuinely need to accept file attachments from anonymous visitors, disable that field type — in Forminator or any other form builder. If it does, confirm that execution permissions are stripped at the filesystem level, not only at the application layer. Application-level controls can be bypassed; a filesystem noexec mount or a blanket .htaccess denial cannot.

At Falcon Internet, upload directory execution lockdowns are part of standard WordPress server provisioning — the kind of baseline that turns a critical plugin CVE into a mandatory update rather than an active incident.