Forminator update fixes critical unauthenticated PHP upload flaw
Critical Forminator flaw can lead to site takeover
A critical vulnerability in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload executable PHP files and achieve remote code execution on affected websites. The issue, tracked as CVE-2026-15748, has a CVSS score of 9.8 and affects Forminator installations through version 1.56.1.
Forminator has more than 600,000 active installations. Security researcher daroo reported the flaw, and Wordfence said successful exploitation can result in complete compromise of a vulnerable site. The vendor addressed the issue in Forminator version 1.56.2, released on July 31, 2026.
How the upload bypass works
The vulnerability is rooted in the plugin's handle_file_upload() function and insufficient validation of user-supplied file types. An attacker can submit a form containing a File Upload field and a Select field, upload an arbitrary file such as crafted PHP code, and potentially execute it on the server.
Wordfence attributed the bypass to exact-key matching in a blocklist of dangerous extensions. Pipe-alternative MIME type keys can evade that matching. The public form-submission handler also trusts attacker-controlled upload-field configuration injected through a forged Select field value.
The prerequisites matter: a site must expose a form containing both of the relevant fields. However, where that condition exists, no authenticated WordPress account is required to attempt exploitation.
Custom storage raises execution risk
In the default configuration, uploaded files are stored in a directory protected by an .htaccess file intended to prevent PHP execution. That safeguard may not apply when an administrator has configured a Custom File Upload Storage root. The protective file is created only when needed during a frontend request, where the WordPress helper that writes it is not loaded.
In that configuration, requesting a malicious uploaded file may cause the web server to execute attacker-controlled PHP. The exposure follows other severe WordPress risks, including WordPress anonymous RCE risk, where unauthenticated activity can also create a route to remote code execution.
Actions for WordPress administrators
Site owners using Forminator should update to version 1.56.2 without delay. They should also identify public forms that combine File Upload and Select fields, review Custom File Upload Storage settings, and confirm that uploaded content cannot execute as server-side code.
A practical priority is to treat plugin updates and upload-directory controls as part of the same operational check: patch the affected plugin, validate exposed form designs, and ensure custom storage retains protections against PHP execution.