Critical WordPress Plugin Bug Exposes 600,000 Sites to File Upload Attacks

Key Takeaways

• A critical vulnerability in the Forminator Forms WordPress plugin allows unauthenticated attackers to upload malicious files.
• Over 600,000 WordPress sites using Forminator Forms versions 1.56.1 and earlier are at risk.
• The flaw, identified as CVE-2026-15748, has a CVSS score of 9.8, indicating severe impact.
• A patch is available in Forminator Forms version 1.56.2; immediate updates are strongly recommended.

Critical WordPress Plugin Flaw Puts 600,000+ Sites at Risk

A severe security vulnerability affecting the popular Forminator Forms plugin for WordPress could enable unauthorized attackers to upload arbitrary PHP files. This critical flaw potentially grants full control over compromised websites, posing a significant threat to a vast number of installations.

The vulnerability, designated CVE-2026-15748, impacts all Forminator Forms versions up to and including 1.56.1. It carries a CVSS severity rating of 9.8, underscoring its critical nature. With more than 600,000 active installations, Forminator Forms is widely used for creating various interactive elements, including contact forms, payment gateways, polls, quizzes, and file upload functionalities. WordPress administrators who have not yet applied the latest security update remain exposed to potential exploitation.

Technical Breakdown of the Vulnerability

The flaw was reported through the Wordfence bug bounty program by security researcher daroo, who received a $2,048 reward for the discovery. Wordfence confirmed the report on July 14, 2026, and promptly informed the Forminator development team the same day. The vendor subsequently released a corrective update, Forminator Forms version 1.56.2, on July 31, 2026.

The vulnerability stems from an issue in Forminator’s file-upload handling mechanism. Attackers can exploit this by injecting a manipulated upload configuration into published forms that utilize the “Select” field. During processing, the plugin incorrectly accepts attacker-controlled values for parameters such as the upload field name, field type, and specific file-handling settings. This malicious request then tricks the plugin into treating the forged data as a legitimate upload configuration.

Crucially, this attack also circumvents the plugin’s built-in file-extension filtering designed to block dangerous executable file types like PHP. While Forminator employs a blocklist for this purpose, researchers discovered that its filtering logic relies on exact matching against file-extension keys. An attacker can bypass this by using a pattern such as ph(p) instead of the blocked php extension. WordPress still interprets ph(p) as a .php file extension, yet Forminator’s blocklist fails to identify and remove it. By combining this forged configuration with an appropriate MIME type, such as text/x-php, an attacker can successfully upload a PHP payload that passes the plugin’s validation checks.

Typically, uploaded files are stored in a directory protected by an .htaccess rule, which prevents PHP execution. However, sites configured with custom file-upload storage locations may lack this crucial protection under specific circumstances. If a malicious PHP file is uploaded to an executable, web-accessible path, an attacker could directly access and execute it, running arbitrary commands on the server.

Successful exploitation of this vulnerability could lead to severe consequences, including remote code execution, deployment of webshells, theft of sensitive WordPress credentials, unauthorized database access, installation of malware, or complete compromise of the affected website.

What You Should Do

• Update Immediately: All administrators using Forminator Forms must update their plugin to version 1.56.2 or later without delay.
• Review Form Configurations: Inspect existing form configurations, particularly those involving file uploads, for any unusual or suspicious settings.
• Inspect Upload Directories: Manually review file upload directories for any unfamiliar or suspicious PHP files that may have been uploaded.
• Verify Execution Protection: Ensure that all directories designated for file uploads are adequately protected against server-side code execution, especially if custom storage locations are in use.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.