Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin
AI analysis
Forminator Forms, a widely used WordPress form-builder plugin, is vulnerable to an unauthenticated arbitrary file upload (CWE-434) in its handle_file_upload function in all versions up to and including 1.56.1. The weakness stems from insufficient file type validation: the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, while the public form-submission handler trusts upload field configuration that an attacker controls by forging a Select field value in a submitted form. An unauthenticated attacker can therefore upload files that may be executable, such as PHP scripts, achieving remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Any WordPress site running Forminator Forms 1.56.1 or earlier, particularly those with publicly reachable forms, is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently assigns a 4.6% probability of exploitation within 30 days (91st percentile).
What to do: Update Forminator Forms to the latest available release (any version after 1.56.1) on all WordPress sites, prioritizing internet-facing sites where forms accept unauthenticated public submissions. Until patched, apply a WAF/virtual patch to restrict uploads through Forminator submission endpoints and inspect the WordPress uploads directory for unexpected PHP or other executable files indicating compromise. No public PoC or in-the-wild exploitation is known yet, but the 4.6% EPSS score (91st percentile) warrants treating patching as urgent.
Affected
| WPMU DEV Forminator Forms (WordPress plugin) | All versions up to and including 1.56.1 (<= 1.56.1) |
Estimated exposure
large≈300,000 sites (Forminator reports roughly 300k active installs on WordPress.org) — Estimated from the plugin's roughly 300,000 active installations reported on WordPress.org, with the caveat that only sites exposing forms to unauthenticated public submissions are practically exploitable.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.