Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.
Intelligence analysis by Llama
A security flaw in Forminator Forms, a WordPress plugin, allows unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, leading to remote code execution and complete site compromise.
Imagine you have a website that lets people upload files. But if someone can trick the website into uploading a special kind of file, they can take control of the website. This is what happened with a security flaw in a popular WordPress plugin called Forminator Forms.
Analysis
Vulnerability Overview
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system.
Exploitation Prerequisites
A key prerequisite for successful exploitation is that the sites must have a form containing both a File Upload field and a Select field. The vulnerability impacts all versions of the plugin before and including 1.56.1.
Patching the Vulnerability
The vulnerability has been addressed in version 1.56.2 released on July 31, 2026. Site owners who have the plugin are advised to apply the updates as soon as possible and ensure their installations are up-to-date.
Additional Context
Another aspect worth noting here is that, in the default configuration, files are uploaded to a directory protected by an .htaccess file that prevents PHP execution. However, if a site administrator has configured a Custom File Upload Storage root, it may not have the same safeguard as the file is created "only when it is first needed, during a frontend request where the WordPress helper responsible for writing the .htaccess file is not loaded." As a result, requesting the uploaded file is enough to cause the web server to execute the attacker-controlled PHP code.
Key points
- A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations.
- The vulnerability allows unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site.
- The vulnerability has been addressed in version 1.56.2 released on July 31, 2026.
If the vulnerability is patched quickly, site owners can rest assured that their installations are secure and less vulnerable to attacks.
However, if the patch is not applied in a timely manner, sites with the vulnerable plugin may be at risk of being compromised, leading to potential data breaches and site takeovers.
