CVE-2026-15748
Forminator Forms unauthenticated arbitrary file upload
Wordfence scores CVE-2026-15748 CVSS 3.1 9.8 in the Forminator Forms WordPress plugin through 1.56.1. Unauthenticated form submission can forge upload field configuration and bypass file-type checks, enabling executable uploads and possible RCE depending on server upload config. Fixed in 1.56.2. About 600,000 active installs. Not in CISA KEV.
- CVSS
- 9.8
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- PoC Available
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- WPMU DEV
- Products
- Forminator Forms
- Affected
- Forminator Forms for WordPress through 1.56.1. Exploitation needs a public form that includes both a File Upload field and a Select field, and RCE further depends on whether the upload location executes PHP.
- Fixed
- 1.56.2 (WordPress.org changelog date 30 July 2026).
- CWE
- CWE-434
- Published
- 18 Aug 2026
- Updated
- 13 Oct 2026
The status above is the claim. Links do not upgrade it.
CVE-2026-15748 is an unauthenticated arbitrary file upload flaw in the Forminator Forms plugin for WordPress, maintained by WPMU DEV. Wordfence, acting as CNA, describes insufficient file-type validation in handle_file_upload, where a dangerous-extension blocklist that matches exact keys can be bypassed with pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected through a forged Select field value. Uploaded files may be executable, which can lead to remote code execution.
Wordfence scores it CVSS 3.1 9.8 (Critical). NVD currently carries that Wordfence Secondary metric and CWE-434, and lists the record as Deferred. WPScan lists the same issue as fixed in 1.56.2 and credits researcher daroo. The WordPress.org changelog for Forminator marks 1.56.2 on 30 July 2026 with “Fix: Arbitrary file upload vulnerability.” The plugin reports about 600,000 active installs; current trunk at check time was newer than the fixed line.
Practical RCE depends on server upload configuration. Wordfence and follow-on reporting note that Forminator’s default upload directory may ship an Apache .htaccess that blocks PHP execution; nginx and some Apache setups that ignore that file remain more exposed. Successful abuse also needs a form that includes both a File Upload field and a Select field.
The CVE is not in the CISA KEV catalog (catalog 2026.10.08). SecurityWeek reported no in-the-wild exploitation at disclosure. The Hacker News and SecurityWeek covered the issue in August 2026.
A third-party GitHub account not affiliated with the credited researcher (0x4cr, repository created 11 October 2026) published a repository claiming lab proofs and an unauthenticated RCE PoC for this CVE. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs. The PoC link field on this record points to that repository; the URL is not repeated in the body.