Unauthenticated Arbitrary File Upload in Forminator Plugin (CVE-2026-15748) Exposes 600,000+ WordPress Sites to RCE
Executive Summary
A critical security vulnerability tracked as CVE-2026-15748 (CVSS v3.1 base score: 9.8) has been disclosed in Forminator Forms, a popular WordPress form builder plugin installed on more than 600,000 active websites. Discovered and reported by security researcher 'daroo', the vulnerability allows unauthenticated remote attackers to upload arbitrary executable PHP files to vulnerable web servers, directly enabling full Remote Code Execution (RCE) and complete site takeover.
Deep-Dive Technical Analysis
Vulnerability Root Cause
The vulnerability stems from improper input validation and file extension verification in Forminator's file handling workflow. Specifically, when a published Forminator form is configured with both a File Upload field and a Select field, the form processing routine introduces a state validation mismatch.
During multi-part form submissions:
* An unauthenticated attacker submits a request containing an executable PHP script (e.g., payload.php).
* By manipulating the Select field parameters in tandem with the upload payload, the request bypasses the plugin's server-side MIME-type and extension sanitization checks.
* Forminator saves the unverified file directly into the server's public upload directory (typically /wp-content/uploads/forminator/).
Exploitation Mechanics
Because the uploaded file retains its .php extension and is placed in an accessible web path, the attacker can execute arbitrary PHP code simply by requesting the file's URL via HTTP GET:
* Web Shell Deployment: Attackers deploy lightweight web shells to execute arbitrary system commands.
* Database Compromise: Attackers extract wp-config.php database credentials to dump WordPress tables, harvest user hashes, and modify administrative accounts.
* Persistence: Threat actors establish persistent backdoors by creating rogue administrator accounts or injecting malicious hooks into functions.php and WordPress cron schedules (wp_schedule_event).
Scope and Vulnerable Versions
* Affected Releases: All Forminator versions up to and including 1.56.1.
* Patched Release: Forminator version 1.56.2, released by vendor WPMU DEV to enforce strict server-side file extension checking.
Industry Impact and Threat Scope
WordPress plugins remain one of the most heavily targeted attack surfaces on the internet. With over 600,000 active deployments, Forminator's widespread adoption in contact forms, registration workflows, and e-commerce checkouts makes this flaw an attractive target for automated botnets and mass-exploitation scanners. Unauthenticated RCE flaws in high-install WordPress plugins are routinely weaponized for search engine optimization (SEO) spam injection, credential harvesting, phishing kit hosting, and cryptomining botnet recruitment.
Actionable Recommendations & Mitigations
1. Immediate Plugin Upgrade: Update Forminator Forms to version 1.56.2 or later immediately.
2. Web Server Hardening: Configure the web server (Nginx or Apache) to prohibit direct execution of PHP scripts in the WordPress uploads directory.
For Nginx:location ~* /wp-content/uploads/.*\.php$ {
deny all;
}
For Apache (.htaccess inside /wp-content/uploads/):
deny from all
3. Web Application Firewall (WAF): Deploy WAF rules to inspect and block multi-part form uploads attempting to deliver .php, .phtml, or .phar extensions through form builder endpoints.
4. Filesystem Integrity Auditing: Scan /wp-content/uploads/forminator/ and parent upload directories for newly created or anomalous .php files, hidden admin user accounts, and modified core theme files.
Sources & References: The Hacker News.