Index

Search

Search the public record. Drafts and scheduled notes are not included.

news

Forminator Forms unauthenticated file upload is CVE-2026-15748

Wordfence disclosed CVE-2026-15748 in Forminator Forms through 1.56.1: forged Select-field data can override upload configuration and bypass file-type checks, enabling unauthenticated executable uploads and possible RCE. Fixed in 1.56.2. CVSS 9.8. About 600,000 active installs. Not in CISA KEV.

Published 3h ago

CriticalPoC Available

CVE-2026-15748

Forminator Forms unauthenticated arbitrary file upload

RCE

Published 18 Aug 2026