Overview
CVE-2026-15748 is a critical unauthenticated arbitrary file upload vulnerability affecting the Forminator Forms plugin for WordPress. The plugin is installed on more than 600,000 active websites. The vulnerability allows remote attackers to upload PHP files and achieve remote code execution.
The vulnerability has a CVSS score of 9.8 (Critical) and affects all versions up to and including 1.56.1. It was fixed in version 1.56.2.
Affected Component
Forminator Forms plugin for WordPress, versions ≤ 1.56.1.
The vulnerability exists in the handle_file_upload function. Insufficient file type validation — specifically exact-key matching in a dangerous-extension blocklist — allows an attacker to bypass the filter and upload executable PHP files.
Research Context
This research was conducted to understand the vulnerability mechanism and develop a detection scanner for authorized security assessment. The scanner performs passive checks to identify WordPress installations using Forminator and assess version-related exposure.
Technical Summary
The vulnerability stems from inadequate validation of file uploads through the plugin's form handling functionality. An unauthenticated user can submit a form with a crafted file payload. The blocklist-based validation performs exact-key matching, which can be bypassed using alternative file extensions or encoding techniques, allowing PHP file upload and subsequent code execution.
Detailed bypass techniques are not published here. The focus is on detection and responsible disclosure.
Testing Environment
Testing was performed in a controlled local WordPress installation with the affected Forminator plugin version. No production systems were targeted. All assessment work was conducted on systems owned or explicitly authorized for testing.
Impact
Successful exploitation allows unauthenticated remote code execution, leading to complete website compromise. The high number of active installations and the unauthenticated nature of the vulnerability make this a significant risk.
Disclosure
The vulnerability was disclosed by security researchers and fixed in Forminator 1.56.2. This page documents the research tool built for detection purposes. The tool is intended for authorized security testing only.
Timeline
-
August 18, 2026
Vulnerability publicly disclosed. Fixed in Forminator version 1.56.2.
-
August–September 2026
Detection scanner developed and published on GitHub for authorized assessment.