A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files, potentially enabling them to take full control of vulnerable websites.

The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8.

Forminator Forms is a widely used drag-and-drop plugin for building contact, payment, poll, quiz, and file-upload forms. With more than 600,000 active installations, the vulnerability poses a significant risk to WordPress administrators who have not yet applied the available update.

WordPress Plugin Vulnerability

The flaw was reported through the Wordfence bug bounty program by security researcher daroo, who received a $2,048 reward for the discovery.

Wordfence validated the report on July 14, 2026, disclosed the issue to the Forminator development team on the same day, and the vendor released a fix in Forminator Forms version 1.56.2 on July 31, 2026.

The flaw in Forminator’s file-upload handling lets attackers inject a forged upload configuration through the Select field in vulnerable published forms.

During processing, Forminator accepts attacker-controlled values such as the upload field name, field type, and file-handling settings. The malicious request can then cause the plugin to treat the forged data as a legitimate upload configuration.

The attack also bypasses the plugin’s dangerous file-extension filtering. Forminator attempts to block PHP and other executable file types using a blocklist.

However, the filtering uses exact matching against file-extension keys. Researchers found that an attacker could use the pattern ph(p) instead of the blocked php extension.

WordPress still interprets ph(p) as matching a .php file extension, while Forminator’s blocklist fails to remove it. By combining the forged configuration with a MIME type such as text/x-php, an attacker may upload a PHP payload that passes validation checks.

Uploaded files are normally placed in a directory protected by an .htaccess rule that prevents PHP execution. However, sites that use a custom file-upload storage location may not receive that protection under certain conditions.

If the uploaded PHP file is stored in an executable web-accessible path, an attacker could directly access it and run arbitrary commands on the server.

Successful exploitation could lead to remote code execution, webshell deployment, theft of WordPress credentials, database access, malware installation, or complete site compromise. Site owners should immediately update Forminator Forms to version 1.56.2 or later.

Administrators should also review existing form configurations, inspect upload directories for suspicious PHP files, and verify that uploaded files cannot execute as server-side code.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks appeared first on Cyber Security News.