300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Summary

A critical arbitrary file upload vulnerability, tracked as CVE-2026-15748, has been discovered in the popular WordPress Forminator Forms plugin. The flaw allows unauthenticated attackers to upload executable files, potentially leading to remote code execution and complete site compromise. While the vulnerability impacts versions up to 1.56.1, it was patched in version 1.56.2.

Full text

A critical vulnerability in the Forminator Forms plugin for WordPress potentially exposes thousands of websites to remote code execution (RCE), WordPress security firm Defiant warns. Tracked as CVE-2026-15748 (CVSS score of 9.8), the bug is described as an arbitrary file upload via the handle_file_upload function of the popular form builder plugin. Insufficient file type validation in the affected function allows unauthenticated attackers to upload executable files, leading to code execution. According to Defiant, the issue is a combination of several weaknesses that enable attackers to forge records using the Select field on a form, take control of the field configuration passed to the upload function, and bypass the plugin’s blocklist of dangerous file types. “This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value,” Defiant explains. In default configurations, files land in a protected directory that prevents PHP execution. However, if a Custom File Upload Storage root has been configured, the protection is not applied to it, and the attacker-supplied PHP code is executed when the uploaded file is requested directly.Advertisement. Scroll to continue reading. “As with all arbitrary file upload vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques,” Defiant notes. The vulnerability impacts all Forminator Forms versions up to 1.56.1 and was patched in version 1.56.2, released on July 31. The plugin has over 600,000 installations and, based on WordPress data, half of them run a vulnerable version. This means that over 300,000 websites are potentially exposed to attacks. Currently, there are no reports of the bug’s in-the-wild exploitation. Related: GitLab Patches Critical Code Injection Vulnerability Related: Dozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates Related: Recent macOS Screen Sharing Vulnerability Exploited in Attacks Related: Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Fortune 500 Companies Hit in Azure Data Theft CampaignTrivy, Not LiteLLM Behind the 2,500 Org Compromise1.6 Million Likely Impacted by RingCentral Data Breach14,000 Trezor Customers Impacted by Data Breach at ShipMonkHackers Exploiting Unpatched GeoServer Zero-DayAmnesiaStealer macOS Malware Steals Data, Controls Browser SessionsAdobe Commerce Bug Targeted Immediately After DisclosureWordPress 7.0.4 Patches Remote Code Execution Vulnerability Latest News Heights Finance Data Breach Impacts at Least 1.2 Million IndividualsGitLab Patches Critical Code Injection VulnerabilityDozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates680,000 Impacted by French Tax Authority Data BreachIrregular Details How a Naming Error Let AI Models Attack a Real Company Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware40,000 Impacted by SafePal Data BreachRecent macOS Screen Sharing Vulnerability Exploited in Attacks Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDali Rajic is joining OpenAI as Chief Revenue Officer.Erika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-15748

Entities