Forminator Forms has a critical flaw. The WordPress plugin, used by more than 600,000 websites, lets attackers upload malicious files without logging in. So that could hand them full control of an affected site.
Researchers call this flaw CVE-2026-15748. It carries a CVSS score of 9.8 out of 10, and affects every Forminator version up to and including 1.56.1. Then WPMU DEV closed the hole in version 1.56.2, released on 31 July.
The flaw became public on 17 to 18 August. That’s just weeks later. Version 1.57.1 was the latest release as of 18 August, though 1.56.2 remains the minimum safe version.
What Is the Forminator Vulnerability?
CVE-2026-15748 is an arbitrary file upload flaw. So it lets attackers upload any file to Forminator Forms without needing a password. That covers every version up to and including 1.56.1.
The flaw lives in the plugin’s handle_file_upload function. Attackers can bypass Forminator’s file-type blocklist by using pipe-alternative MIME type keys instead of the blocked ones.
A forged Select field value fools the submission handler. That trick lets an unauthenticated attacker slip past validation and upload files Forminator would normally reject. If the server can run the uploaded file, the attacker then gains full control. That outcome is called remote code execution, or RCE.
By default, Forminator stores uploads in a folder protected by a file called .htaccess. This file blocks PHP code from running there. But sites that use a custom upload folder without this protection face a higher RCE risk.
Which WordPress Sites Are at Risk?
Not every Forminator setup faces the same risk. That’s because it depends on how the plugin is set up and which fields a form uses.
The attack only works on forms that have both:
- A File Upload field
- A Select field
Why WordPress Sites Need to Patch Forminator
If your site uses Forminator, you should patch it. No attacks have been confirmed yet. Still, the flaw is public, carries a 9.8 severity score, and needs no login to exploit. In addition, it runs on more than 600,000 sites, according to WordPress plugin directory data.
With the technical details now public, attackers have more information to target unpatched sites. WPMU DEV shipped the fix on 31 July. Later Forminator updates have also patched other issues, including XSS, PHP object injection, and privilege escalation.
What Should WordPress Site Owners Do Now?
Treat this as urgent. Update Forminator to at least version 1.56.2 to fix the known flaw. Businesses should also check if their site was exposed while a vulnerable version was active.
Look beyond the plugin itself. Check affected forms, recent activity, unexpected files, and other signs of compromise, too.
Legend DigiTech can check your site. First, we look at whether the vulnerable plugin was active, which forms were exposed, and any signs of suspicious activity.
Our WordPress security review includes:
- Checking Forminator and other installed plugins for known flaws.
- Reviewing forms that use file uploads and other affected features.
- Checking recent submissions and website activity for unusual behaviour.
- Looking for unexpected files or changes linked to possible breaches.
- Reviewing WordPress core, plugins, and themes for other security risks.
- Recommending and applying the fixes you need.
This fixes the immediate Forminator flaw. It also uncovers other weaknesses attackers could exploit later.
