WordPress Forminator Vulnerability Allows Remote Code Execution

Wordfence, a WordPress security company, has published details of a critical security flaw in Forminator Forms, a WordPress plugin with more than 600,000 active installations. WordPress is a popular website platform, and a plugin is a software add-on that extends what a site can do. The flaw is tracked as CVE-2026-15748 and carries a CVSS severity score of 9.8 out of 10.0, where CVSS is a standard scoring system used to rate how serious a vulnerability is. It was discovered and reported by a security researcher using the online alias 'daroo.' According to Wordfence, the vulnerability makes it possible for an unauthenticated attacker, meaning someone with no login account, to upload arbitrary files, including executable PHP files. PHP is a scripting language used to build and run many WordPress sites. That can lead to WordPress remote code execution, which means the attacker can run their own commands on the server and take full control of the site.

For an attack to succeed, the targeted site must have a form that includes both a File Upload field and a Select field. A File Upload field lets visitors attach a file to a submitted form, and a Select field is a dropdown list from which a visitor chooses an option. The vulnerability affects all versions of the plugin before and including version 1.56.1. It has been addressed in version 1.56.2, released on July 31, 2026. Site owners using the plugin should update as soon as possible.

The flaw is a case of a file upload vulnerability that resides in a part of the plugin that processes uploaded files called handle_file_upload(). Wordfence explains that the function does not sufficiently validate the type of file supplied by the user. An attacker can submit a specially crafted form that uploads a malicious PHP file, then request that file to make the web server execute it. The report states that the dangerous-extension blocklist performs exact-key matching, which is bypassed by pipe-alternative MIME type keys. A MIME type is a label that tells software what kind of file something is, and a pipe-alternative key is a label that includes a vertical bar with an alternative type, which the exact-key matching does not catch. The public submission handler also trusts attacker-controlled upload field configuration injected through a forged Select field value. This combination lets an unauthenticated attacker place executable code on the server.

There is an important nuance about where uploaded files are stored. In the default configuration, files are uploaded to a directory protected by an .htaccess file, which is a server configuration file that prevents PHP code from running. However, if a site administrator has configured a Custom File Upload Storage root, that directory may not have the same safeguard. Wordfence notes that the .htaccess file is created only when it is first needed, during a frontend request where the WordPress helper responsible for writing it is not loaded. As a result, simply requesting the uploaded file can be enough to cause the web server to execute the attacker-controlled PHP code.

The Forminator disclosure comes days after Wordfence also highlighted a separate critical authentication bypass bug in User Profile Builder, another WordPress plugin with more than 40,000 active installations. That vulnerability is tracked as CVE-2026-15826 and also has a CVSS score of 9.8. It was patched on July 16, 2026, with the release of version 3.16.5. All prior versions are affected, but it is only exploitable on sites where the plugin's Automatically Log In setting is enabled. The flaw involves the wppb_log_in_user() function, which calls absint() on the return value of wp_insert_user() before checking whether an error occurred with is_wp_error(). Here, wp_insert_user() is a WordPress function that creates a new user account, is_wp_error() checks whether an error object was returned, and absint() converts a value to an absolute integer. When a registration is submitted with a username that is 61 to 70 characters long, WordPress core rejects it with an error object, but absint() turns that object into the integer 1 before the error check can stop the process. This causes the plugin to bind and return a transient-backed autologin nonce tied to user ID 1, which is normally the first and most powerful admin account on a WordPress site. A nonce is a one-time token used to prove a request is legitimate. An unauthenticated attacker can then log in as that administrator and take over the site.

Site owners who have either of the two plugins are advised to apply the updates as soon as possible and ensure their installations are up-to-date. For WordPress site owners who prefer managed hosting that is secured end to end, AEU Hosting offers managed WordPress hosting, secured end to end, which can complement prompt plugin updates. If you run a WordPress site, check your installed plugins and update Forminator Forms to at least version 1.56.2 and User Profile Builder to at least version 3.16.5 if you use them.