Forminator CVE-2026-15748 is an unauthenticated arbitrary file-upload vulnerability in the popular WordPress forms plugin that lets an attacker upload a PHP web shell and reach remote code execution, and roughly 300,000 live sites are still running a vulnerable version. It carries a CVSS score of 9.8, is categorized as CWE-434, affects all Forminator versions up to and including 1.56.1, and is fixed in version 1.56.2. Forminator has over 600,000 active installations, so at disclosure about half the install base was exposed.

The bug sits in the plugin's handle_file_upload function. Its dangerous-extension blocklist uses exact-key matching, which an attacker bypasses with pipe-alternative MIME-type keys, and a public submission handler trusts attacker-controlled upload-field configuration injected through a forged Select-field value. The practical trigger condition matters: exploitation requires a published form that contains both a File Upload field and a Select field. Where that combination exists, an unauthenticated visitor can drop an executable payload into the uploads tree.

This is the blocklist-versus-allowlist lesson the WordPress ecosystem keeps relearning. Filtering out .php and its variants invites bypass; only accepting a known-good set of extensions does not. The flaw was found by researcher "daroo" through the Wordfence bug-bounty program and disclosed responsibly, but with a patch public and a patch diff to study, mass scanning of Forminator endpoints began quickly, and automated syndicates that turn upload RCEs into persistent backdoors and injected redirects are the expected follow-on.

Am I vulnerable, and where would a web shell land?

If your Forminator forms use only text, email, radio, or similar fields, this specific unauthenticated path cannot be triggered, because the chain needs both a File Upload field and a Select field on a published form. You should still update immediately, since hidden or future forms can reintroduce the condition. If you are hunting for compromise, check /wp-content/uploads/forminator/ and the standard monthly upload directories for newly created .php, .phtml, or double-extension files (for example image.png.php) with timestamps near form submissions.

How do I block this even before patching?

Update to 1.56.2 as the real fix. As defense in depth, disable PHP execution in the uploads tree at the web-server layer, which neutralizes an entire class of upload-to-RCE bugs regardless of plugin logic. On Nginx, deny requests to */wp-content/uploads/*.php. On Apache or LiteSpeed, drop a .htaccess into wp-content/uploads that denies FilesMatch for php, phtml, php3-php7 and phps. A WAF such as Wordfence provides signature-based coverage, but encoding and MIME-boundary tricks can bypass generic rules, so treat the WAF as a stopgap rather than the fix.

Our read

A CVSS 9.8, unauthenticated, no-interaction file upload is about as bad as web bugs get, and the story here is not the bug, it is that 300,000 sites sat unpatched two weeks after a fix existed. That gap is the real risk surface. The pillar that applies is understanding risk through inventory: you cannot patch what you do not know you run, and "we use WordPress" is not an asset list. Knowing exactly which sites run Forminator, at which version, with which field types, is the difference between a one-line update and a breach notification. Verifiable by design starts with knowing what you have.

Reporting by SecurityWeek; CVSS and version data per NVD and Wordfence. Sources linked above.

Related: the Chrome VPN extensions traffic-hijack campaign and SharePoint CVE-2026-50522 active exploitation.