CVE-2026-15748: Forminator WordPress Plugin — Unauthenticated RCE Risk (July 2026)

CVE-2026-15748 — Forminator WordPress Plugin

CVE-2026-15748 is a critical vulnerability in the Forminator Forms WordPress plugin (up to v1.56.1) that allows unauthenticated attackers to upload arbitrary PHP files and execute remote code. This flaw is not known to be under active exploitation as of publication, but its criticality and ease of exploitation demand immediate action.

Attack Vector

Attackers exploit insufficient file type validation in Forminator’s file upload functionality. By sending a crafted HTTP POST request to the plugin’s upload endpoint, an unauthenticated user can upload a malicious PHP file. If the site stores uploads in a web-accessible directory without execution restrictions, the attacker can trigger the payload remotely, achieving full remote code execution. Sites with custom file upload storage paths or missing .htaccess/permissions are especially exposed. No authentication or user interaction is required.

Who Is at Risk

All WordPress sites running Forminator Forms versions up to and including 1.56.1 are vulnerable. Organizations using custom file upload storage configurations or lacking web server execution controls are at heightened risk. The vulnerability impacts both default and customized deployments of Forminator. Site owners and administrators using Forminator should assume exposure until patched.

Patch & Mitigate

• Patch: Upgrade Forminator Forms to version 1.56.2 or later (released July 31, 2026) immediately.
• Workaround: Restrict file upload directories with .htaccess or equivalent to disallow PHP execution. Disable file uploads if not required.
• Detect: Review web server logs for unexpected POST requests to Forminator endpoints and look for unfamiliar PHP files in upload directories. Monitor for new or modified files and suspicious admin logins.

MITRE ATT&CK

• TA0001 — Initial Access: Exploitation allows direct access to the target environment without authentication.
• TA0005 — Defense Evasion: Malicious uploads can bypass weak file validation and evade basic security controls.

Source: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html