Forminator WordPress plugin flaw allows unauthenticated RCE

A critical vulnerability in the Forminator WordPress plugin can let unauthenticated attackers upload PHP files and take full control of affected websites, according to a report published by the WordPress security company Wordfence. The flaw is tracked as CVE-2026-15748 and carries a CVSS score of 9.8 out of 10.0, a rating reserved for the most severe issues. Forminator Forms, the plugin concerned, is used on more than 600,000 active WordPress installations. Wordfence says the vulnerability was discovered and reported by a security researcher who works under the online alias "daroo".

According to Wordfence's report, unauthenticated attackers, meaning anyone who can reach a website's public pages without logging in anywhere, can upload arbitrary files, including executable PHP files. PHP is the programming language in which WordPress and the majority of its plugins are written, so a PHP file that runs on the server hands the attacker the ability to execute their own code there. Wordfence describes the outcome as remote code execution and complete site compromise.

There is an important condition attached to the exposure. Wordfence says successful exploitation requires that the site has a form containing both a File Upload field and a Select field, the two field types a visitor would recognise as a box for attaching a file and a drop-down menu for choosing an option. Sites whose forms do not combine those two field types are not exposed in that way.

The flaw is a case of arbitrary file upload located in the plugin's handle_file_upload() function, and in Wordfence's account it stems from insufficient validation of the file types accepted from user-supplied input. Specifically, the blocklist of dangerous file extensions performs exact-key matching, which the report says is bypassed by pipe-alternative MIME type keys. MIME types are standard labels, such as text/plain or image/jpeg, that describe what kind of data a file holds, and they are what a browser sends alongside an upload. The second half of the problem is a public submission handler that trusts upload field configuration controlled by the attacker and injected through a forged Select field value. Put together, these two weaknesses let an attacker submit a form and have a file of their choosing stored on the site.

Wordfence also points to a detail that decides how badly a given site is affected. In the default configuration, uploaded files land in a directory protected by an .htaccess file, a small configuration file that the web server reads and that blocks PHP files in that folder from being executed. But if a site administrator has set a Custom File Upload Storage root, that safeguard may not exist there, because the file is created only when it is first needed, during a frontend request in which the WordPress helper responsible for writing the .htaccess file is not loaded. In that situation, simply requesting the uploaded file over the web is enough to make the server run the attacker's PHP code.

All versions of Forminator Forms up to and including 1.56.1 are affected. Wordfence says the issue has been addressed in version 1.56.2, which was released on July 31, 2026.

The Forminator disclosure came days after Wordfence highlighted a second critical bug, this one in User Profile Builder, a WordPress plugin with more than 40,000 active installations. Tracked as CVE-2026-15826 and also rated 9.8 on the CVSS scale, it is an authentication bypass, a class of flaw that lets someone get into an account without knowing that account's password. Wordfence says an unauthenticated attacker could log in as the user with ID 1, which on most WordPress sites is the administrator account, and from there seize control of the site. The problem was patched on July 16, 2026 with the release of version 3.16.5. Every earlier version is affected, but according to Wordfence it is only exploitable on sites where the plugin's Automatically Log In setting is switched on.

The mechanism behind the User Profile Builder flaw is a small coding detail with a large consequence. Wordfence explains that the plugin's wppb_log_in_user() function calls absint() on the value returned by wp_insert_user() before it performs an is_wp_error() check. When a registration is submitted with a username between 61 and 70 characters long, WordPress core rejects it and hands back a WP_Error object, but absint() converts that object into the integer 1 before the error check can stop execution. The plugin therefore binds and returns a temporary autologin token, known as a nonce, that is tied to user ID 1. That is what allows an unauthenticated visitor to end up signed in as the site's administrator, which Wordfence describes as full administrative takeover.

Taken together, the two cases show a familiar pattern rather than a rare one. Both affected plugins are widely installed, both flaws were given the maximum severity band of 9.8, neither requires the attacker to hold an account on the site, and in both cases the fix is already available from the plugin vendor. Neither issue, according to the reports, involves a mistake in WordPress itself; the flaws sit in the plugin code, which is why the remedy is a plugin update rather than a change of platform.

For site owners running either plugin, Wordfence's advice is to apply the updates as soon as possible and to make sure installations are up to date. It is worth checking rather than assuming: the Plugins page in the WordPress dashboard shows the version number installed for each plugin and flags any update that is waiting, and on many sites automatic plugin updates are switched off by choice or by default. Sites that use Forminator should look at their forms and confirm whether any of them combines a file upload box with a drop-down selection box, and should also check whether uploads are stored in a custom folder, since that configuration is exactly the one where the .htaccess protection described by Wordfence is missing. Where a custom storage location was set up by a developer or an agency, that is the person to ask about it.

Anyone who would rather not follow plugin releases themselves can look at AEU Hosting, our managed WordPress hosting service, which takes care of running and maintaining the hosting side of a WordPress site, with the details of what is included set out on its own service page at albhosting.eu.

One final point is worth stating plainly. Neither CVE-2026-15748 nor CVE-2026-15826 has been described by the source as exploited in the wild; what has been reported is the technical flaw, the prerequisites for abuse and the availability of fixes. Wordfence's disclosures are the primary source for everything above, and the plugin vendors are the ones who shipped the patched versions.