On July 14, 2026, a significant security breach was reported concerning the Forminator Forms plugin, a popular tool for WordPress boasting over 600,000 active installations. This unauthenticated arbitrary file upload vulnerability enables unauthorized attackers to upload potentially harmful files, including executable PHP files, to affected websites. If exploited, this could lead to remote code execution and total site compromise. The vulnerability specifically affects sites that utilize a form featuring both a File Upload and a Select field.
We commend security researcher daroo for identifying and responsibly disclosing this vulnerability through the Wordfence Bug Bounty Program. For this, daroo was awarded a bounty of $2,048. Our commitment to bolstering the WordPress ecosystem’s security drives our collaboration with skilled researchers through initiatives like the Bug Bounty Program.
All users of Wordfence—including those subscribed to Wordfence Premium, Wordfence Care, and Wordfence Response, as well as those utilizing the free version—are shielded from exploits targeting this vulnerability thanks to the Malicious File Upload protection integrated into the Wordfence firewall.
Disclosure Timeline
Details of the disclosure were communicated to the Forminator team through our Wordfence Vulnerability Management Portal on July 14, 2026. The developers acknowledged the report by July 20, 2026, and released the patched version on July 31, 2026. We acknowledge the Forminator team’s swift and effective response in addressing this issue.
Users are strongly encouraged to upgrade to the latest version of Forminator Forms, 1.56.2, as promptly as possible to mitigate risks associated with this vulnerability.
Vulnerability Overview
The vulnerability is identified as CVE-2026-15748 and carries a CVSS rating of 9.8 (Critical). Affected versions are 1.56.1 and earlier, with the patched release being 1.56.2.
The Forminator Forms plugin, which facilitates the creation of contact forms, payment forms, and custom forms, exhibits a flaw in the handle_file_upload function due to inadequate file type validation. Specifically, the dangerous file extension blocklist contains vulnerabilities that can be exploited to bypass security measures.
In-Depth Technical Analysis
This vulnerability results from a series of interconnected flaws that permit an unauthenticated actor to upload an executable PHP file onto the web server. Analysis of the code indicates that the plugin processes form submissions through a function in the Forminator_CForm_Front_Action class, allowing attackers to compromise the internal field data by manipulating the Select field.
When a legitimate File Upload field exists in a form, the upload-processing phase incorrectly trusts the configuration provided by an attacker. This oversight allows the attacker to enable dangerous file types, potentially leading to remote code execution.
While files are generally uploaded to a directory shielded by an .htaccess file to prevent PHP execution, administrators may inadvertently expose their sites to risk by adjusting settings related to Custom File Upload Storage. Such changes may lead to inadequate directory protections, allowing for direct execution of malicious PHP code.
Conclusion
This advisory highlighted a critical vulnerability within the Forminator Forms plugin, affecting all versions up to 1.56.1. This flaw enables unauthorized individuals to upload executable files and gain remote access to compromised sites. The issue has been wholly resolved in version 1.56.2.
We urge WordPress users to ensure their installations are updated to the latest version of Forminator Forms to safeguard their sites against potential exploits. Additionally, all Wordfence users benefit from our firewall’s protections against this vulnerability.
If you know anyone utilizing the Forminator Forms plugin, please share this information to help maintain site security, as this vulnerability presents substantial risks.
