Arbitrary File Upload Vulnerability in Forminator Forms Plugin by WordPress
CVE-2026-15748

9.8CRITICAL

Key Information:

Vendor: WordPress
Status: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Vendor: CVE Published:; 18 August 2026

Badges

📈 Trended📈 Score: 3,840👾 Exploit Exists🟡 Public PoC📰 News Worthy

What is CVE-2026-15748?

CVE-2026-15748 is a critical vulnerability found in the Forminator Forms plugin, which is widely used within WordPress environments to create and manage forms. The vulnerability arises from a flaw in the plugin’s handling of file uploads, specifically due to insufficient validation of file types in the handle_file_upload function. This allows malicious actors to exploit the plugin's open submission mechanism by bypassing the blocklist meant to prevent the upload of dangerous file types. Consequently, unauthenticated attackers can upload potentially executable files, leading to the serious risk of remote code execution on the affected web server.

Given the popularity of WordPress and the prevalence of the Forminator Forms plugin, organizations utilizing this plugin are significantly at risk if they do not address this vulnerability. An successful exploitation could allow attackers to gain unauthorized access to the server, execute malicious code, and potentially manipulate or exfiltrate sensitive data.

Potential impact of CVE-2026-15748

Remote Code Execution: Successful exploitation of this vulnerability can lead to remote code execution, enabling attackers to run arbitrary commands on the server. This could facilitate complete control over the web application and the underlying server.
Data Breaches: The ability to execute code remotely may provide unauthorized access to sensitive data stored on the server, resulting in potential data breaches. This could include personal identifiable information (PII), customer data, and confidential information critical to the organization.
Widespread Web Compromise: Given the popularity of WordPress and the Forminator plugin, the potential for widespread exploitation increases. If attackers successfully target multiple sites using the vulnerable plugin, it could lead to a surge in compromised websites, affecting not just the targeted sites but also their users and clients, ultimately damaging trust and reputation.

Affected Version(s)

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 0 <= 1.56.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-15748
Created by ubaydev

News Articles

Webpronews

CVE-2026-15748

Forminator's Critical Upload Flaw Puts 600,000 WordPress Sites at Risk of Instant Takeover

A critical unauthenticated arbitrary file upload vulnerability in the Forminator WordPress plugin threatens over 600,000 sites with remote code execution. CVE-2026-15748 allows attackers to bypass file type checks via forged form fields when both upload and select elements are present. Sites using c...