Vulnerability Overview: CVE-2026-15748 in Forminator Forms

A severe security flaw, identified as CVE-2026-15748, has been discovered in the popular Forminator Forms WordPress plugin. This vulnerability allows unauthenticated attackers to achieve Remote Code Execution (RCE) on websites utilizing the plugin. The exploit leverages a flaw in how the plugin handles upload settings for select fields, enabling attackers to trick the system into executing arbitrary code.

This critical vulnerability affects approximately 600,000 WordPress sites that have the Forminator Forms plugin installed and are running a vulnerable version. The discovery was reported by Wordfence Intelligence, with the original research originating from Wordfence. The severity has been classified as High, indicating a significant risk to affected websites.

The attack vector involves manipulating the upload settings associated with select fields within forms created by Forminator. By crafting malicious requests, an attacker can bypass security checks and upload arbitrary files to the server. Once a malicious file is uploaded, the attacker can then trigger its execution, leading to full compromise of the affected WordPress site. This means an attacker could potentially deface the site, steal sensitive data, install malware, or use the compromised server for further malicious activities.

The lack of authentication required for this exploit is particularly concerning. It means that any visitor to a vulnerable website, not just logged-in administrators or users, could potentially trigger the vulnerability. This dramatically increases the attack surface and the likelihood of exploitation.

Technical Details of the Exploit

The core of the vulnerability lies in the plugin's handling of file uploads, specifically when configured within select fields. Forminator Forms allows users to create complex forms, including those that permit file uploads. The plugin's logic for validating and processing these uploads, particularly when tied to select field options, contains a critical oversight.

Attackers can craft specially designed form submissions that send forged upload settings. These forged settings trick the plugin into accepting and processing a file that should have been rejected. This could involve bypassing file type restrictions, size limits, or even directory restrictions. The precise mechanism involves manipulating parameters that control where uploaded files are stored and how they are processed. By exploiting this, an attacker can upload a web shell or any other malicious script to a location on the server that is accessible via a web browser.

Once the malicious file is uploaded, the attacker needs a way to execute it. This is often achieved by knowing or guessing the location where the file was saved. The attacker then accesses this file through a URL, causing the web server to execute the script. This grants the attacker the ability to run commands on the server, effectively achieving Remote Code Execution.

The issue was identified and patched by the Forminator Forms development team. Users are strongly advised to update to the latest version of the plugin immediately to mitigate this risk. The specific version that addresses this vulnerability is 1.27.5.

Mitigation and Patching

The most crucial step for any WordPress site administrator using Forminator Forms is to update the plugin to version 1.27.5 or later. This patched version addresses the specific flaw that allows for unauthenticated RCE.

For users who cannot immediately update, or as an additional layer of security, several other measures can be taken:

  • Disable File Uploads: If file uploads are not essential for your forms, consider disabling this feature within Forminator Forms settings.
  • Web Application Firewall (WAF): Employing a Web Application Firewall can help detect and block malicious requests that attempt to exploit this vulnerability. Many security plugins for WordPress include WAF capabilities.
  • Server-Level Security: Ensure your web server is properly secured, with appropriate file permissions and security configurations in place.
  • Regular Backups: Maintain regular backups of your website files and database. This is essential for recovery in the event of a successful compromise.

The vulnerability was disclosed responsibly by Wordfence, who provided the details to the Forminator Forms developers. The patch was released swiftly after the discovery, highlighting the collaborative effort in the WordPress security ecosystem.

Impact and Recommendations

The potential impact of CVE-2026-15748 is severe. An RCE vulnerability allows an attacker to gain complete control over the affected website. This can lead to:

  • Data Breaches: Sensitive user data, including personal information, login credentials, and payment details, could be stolen.
  • Website Defacement: Attackers can alter the content of the website, spreading misinformation or damaging brand reputation.
  • Malware Distribution: The compromised site can be used to host and distribute malware to unsuspecting visitors.
  • Phishing Attacks: The site could be repurposed for phishing campaigns, tricking users into revealing sensitive information.
  • Spam Operations: The server might be used to send out large volumes of spam emails.
  • Further Network Compromise: A compromised web server can serve as a pivot point for attackers to move laterally within a larger network.

Given that Forminator Forms is used by hundreds of thousands of sites, this vulnerability poses a widespread threat. WordPress administrators must prioritize updating the plugin. If automatic updates are enabled, ensure they are functioning correctly. For manual updates, log in to the WordPress admin dashboard, navigate to Plugins > Installed Plugins, and update Forminator Forms if an update is available.

The fact that this exploit requires no authentication makes it particularly dangerous. It means attackers do not need any prior knowledge of the website or its users to initiate an attack. This is a classic example of how a single flaw in a widely used plugin can have cascading effects across the internet.

What remains to be seen is whether attackers have already begun exploiting this vulnerability in the wild before the patch was widely applied. Security researchers will be closely monitoring for any signs of active exploitation, which could accelerate the urgency for site owners to update.