Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.
Wordfence reported CVE-2026-15748 (CVSS 9.8) in Forminator Forms, a WordPress plugin with over 600,000 active installations, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw stems from insufficient file type validation in the handle_file_upload() function, and exploitation requires a form containing both a File Upload field and a Select field, plus a custom upload storage root lacking .htaccess PHP protection. All versions up to and including 1.56.1 are affected; version 1.56.2 released July 31, 2026 fixes the issue. Wordfence also disclosed CVE-2026-15826 (CVSS 9.8), an authentication bypass in User Profile Builder (40,000+ installs) letting unauthenticated attackers log in as administrator, fixed in version 3.16.5 on July 16, 2026.
- Forminator Forms flaw (CVE-2026-15748, CVSS 9.8) enables unauthenticated RCE via malicious PHP uploads.
- Exploitation requires a form with both File Upload and Select fields, plus unprotected custom upload storage.
- Patch available in Forminator version 1.56.2; all versions through 1.56.1 are vulnerable.
- CVE-2026-15826 in User Profile Builder allows unauthenticated login as user ID 1 when auto-login is enabled.
- WordPress site owners urged to update both plugins promptly.
- Tags
- arbitrary-file-uploadauthentication-bypassforminator-formsplugin-securityrceuser-profile-builderwordfencewordpress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15748 | Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin | 9.8 | 4% | PoC | |
| CVE-2026-15826 | Unauthenticated Admin Login Bypass in WordPress User Profile Builder Plugin (≤3.16.4) | 9.8 | 4% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 17, 2026 Vulnerability / Website Security A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748 , is rated 9. 8 out of 10.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.