Forminator Forms unauthenticated file upload is CVE-2026-15748
Wordfence disclosed CVE-2026-15748 in Forminator Forms through 1.56.1: forged Select-field data can override upload configuration and bypass file-type checks, enabling unauthenticated executable uploads and possible RCE. Fixed in 1.56.2. CVSS 9.8. About 600,000 active installs. Not in CISA KEV.
Published 13 Oct 2026
What happened
On 17–18 August 2026 Wordfence and follow-on coverage disclosed CVE-2026-15748 in Forminator Forms, the WPMU DEV WordPress form plugin. Wordfence’s CNA description says the plugin is vulnerable to arbitrary file upload through handle_file_upload in versions up to and including 1.56.1. The dangerous-extension blocklist uses exact-key matching that can be bypassed with pipe-alternative MIME type keys, and the public submission handler trusts attacker-controlled upload field configuration injected via a forged Select field value. Unauthenticated attackers may upload files that can be executable, which makes remote code execution possible.
Wordfence scores the issue CVSS 3.1 9.8 (Critical). NVD carries that Wordfence Secondary score and CWE-434. WPScan credits researcher daroo. The WordPress.org changelog lists 1.56.2 on 30 July 2026 as fixing an arbitrary file upload vulnerability; outlets commonly cite 31 July 2026 for the fixed release window.
Who is affected
Sites running Forminator Forms through 1.56.1 are in scope. WordPress.org reports about 600,000 active installs for the plugin. SecurityWeek, citing WordPress version-share data at disclosure, estimated that roughly half of those installs were still on vulnerable builds (on the order of 300,000 sites).
Exploitation of the upload path requires a public form that includes both a File Upload field and a Select field. Turning an upload into remote code execution further depends on server configuration: whether the upload directory allows PHP (or other) execution. Default Apache .htaccess protections shipped with the plugin can block PHP execution; nginx and hosts that ignore that file are more exposed.
What is confirmed
Wordfence’s CVE record, WPScan, the Forminator 1.56.2 changelog entry, The Hacker News, and SecurityWeek agree on the unauthenticated arbitrary file upload impact, the 1.56.1 / 1.56.2 version boundary, the Select-field plus upload-field precondition, and the CVSS 9.8 score from Wordfence. Researcher credit is daroo.
The CVE is not in the CISA KEV catalog (catalog 2026.10.08). SecurityWeek stated there were no reports of in-the-wild exploitation at the time of its article. ThreatWire found no separate claim that Wordfence had already blocked mass attacks specifically for this CVE ID.
A third-party GitHub account not affiliated with the credited researcher (0x4cr, repository created 11 October 2026; account created August 2025) published a repository claiming lab proofs and an unauthenticated RCE PoC for CVE-2026-15748. ThreatWire has not run or verified it. Treat third-party PoC repos with caution and only test in isolated labs.
What is not confirmed
Active exploitation in the wild is not established by Wordfence, CISA, The Hacker News, or SecurityWeek in the sources above.
ThreatWire has not independently reproduced the third-party lab material linked from this record. Whether every hosting layout yields RCE from a successful upload remains environment-dependent.
What to do
Update Forminator Forms to 1.56.2 or later through the WordPress plugin updater. After upgrading, inspect the uploads directory and related paths for unexpected executable files, and review web logs for suspicious public form POSTs if the site was exposed while unpatched. Prefer hosting that denies script execution in upload directories.
Sources: Wordfence threat intel / CVE text, WPScan, wordpress.org/plugins/forminator changelog, The Hacker News (18 August 2026 coverage), SecurityWeek (18 August 2026), NVD, CVE.org, CISA KEV catalog 2026.10.08 (not listed).