Forminator Word Press Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Summary: A critical flaw in the Forminator Forms WordPress plugin, installed on more than 600,000 sites, allows unauthenticated attackers to upload arbitrary files including executable PHP, leading to remote code execution and full site compromise. Tracked as CVE-2026-15748 and rated 9.8 on CVSS, the bug affects all versions through 1.56.1 and was fixed in 1.56.2 on July 31, 2026; exploitation requires a form with both a File Upload field and a Select field.
Why it matters: The bypass works because the dangerous-extension blocklist uses exact-key matching that pipe-alternative MIME type keys slip past, and any site using a Custom File Upload Storage root may lack the .htaccess protection that blocks PHP execution by default. With 600,000 active installations and no authentication required, the exposure is broad and the path to full site takeover is a single form submission.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-15748 CVE-2026-15826
Related: ⚡ Weekly Recap: AI-Powered PLC Attacks, Git Lab Attacks, Stripe Key Leaks and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026