A critical vulnerability in the Forminator Forms plugin for WordPress can allow unauthenticated attackers to upload malicious PHP files and, under certain conditions, execute arbitrary code on the server.
The flaw, identified as CVE-2026-15748 and scored 9.8 on the CVSS scale, affects all versions up to 1.56.1. The plugin, which boasts more than 600,000 active installations, is widely used to create forms, surveys, payment integrations, quizzes, and file upload fields.
Exploitation requires a published form that simultaneously includes both a File Upload field and a Select field. Attackers can manipulate data submitted through the Select field to create a fake upload configuration accepted by the plugin. This technique also bypasses restrictions on dangerous file extensions.
By using a variation in file type identification, the attacker can make a PHP file pass the checks intended to block executable content. Once the file is placed in a web-accessible directory, the attacker can execute commands, install web shells, steal credentials, access databases, and fully take over the site.
The vulnerability was fixed in Forminator 1.56.2, released at the end of July. Subsequent versions, including 1.57.0, are now available to users.
