CVE-2026-15748: Forminator Forms WordPress Plugin RCE Flaw

CVE-2026-15748 Overview

The Forminator Forms plugin for WordPress contains an arbitrary file upload vulnerability affecting all versions up to and including 1.56.1. The flaw resides in the handle_file_upload function, where insufficient file type validation allows attackers to bypass the dangerous-extension blocklist. Unauthenticated attackers can upload executable files, leading to remote code execution (RCE) on affected sites. The vulnerability is tracked under [CWE-434] (Unrestricted Upload of File with Dangerous Type).

Critical Impact
Unauthenticated attackers can upload arbitrary executable files to vulnerable WordPress sites, resulting in remote code execution and full site compromise.

Affected Products

Forminator Forms plugin for WordPress, versions up to and including 1.56.1
WordPress sites with public form submission enabled via Forminator
Any WordPress installation using the vulnerable handle_file_upload code path

Discovery Timeline

2026-08-18 - CVE-2026-15748 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-15748

Vulnerability Analysis

The vulnerability lives in the Forminator plugin's handle_file_upload function. This function enforces a blocklist of dangerous file extensions to prevent executable uploads. However, the check performs exact-key matching against MIME type entries, which does not account for MIME type keys that use pipe-alternative syntax (for example, keys containing | as a delimiter between multiple values).

Attackers submit pipe-alternative MIME type keys that never match the blocklist entries. The dangerous-extension filter is bypassed, and files with executable extensions such as .php reach the upload directory. Because the flaw sits on the public submission handler, no authentication is required.

A second defect amplifies the impact. The public submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value. Attackers redefine upload field parameters at submission time, overriding server-side constraints intended to restrict file destinations and types.

Root Cause

The root cause is improper input validation combined with untrusted configuration reuse. The blocklist relies on exact-key comparison rather than normalized MIME type parsing. The submission handler treats attacker-supplied form configuration as authoritative instead of loading the trusted server-side field definition.

Attack Vector

Exploitation requires only network access to a form page. An unauthenticated attacker submits a crafted POST request to the Forminator submission endpoint, injecting a forged Select field value that redefines the upload field configuration. The attacker then attaches a payload file using a pipe-alternative MIME type key that evades the dangerous-extension blocklist. Once uploaded, the attacker requests the file directly to trigger code execution under the web server user.

Review the vulnerable code paths in the WordPress Forminator Upload Field Code, the Forminator Helper Fields Code, and the Custom Forms Front Action.

Detection Methods for CVE-2026-15748

Indicators of Compromise

New files with executable extensions such as .php, .phtml, or .phar appearing under the wp-content/uploads/forminator/ directory
POST requests to Forminator submission endpoints containing manipulated Select field values referencing upload field configuration keys
Multipart form uploads that carry MIME type values containing pipe (|) characters
Web server access logs showing direct GET requests to recently created files inside Forminator upload paths

Detection Strategies

Inspect WordPress upload directories used by Forminator for files whose extension does not match a document, image, or archive type
Monitor web server logs for submissions to admin-ajax.php invoking Forminator form actions followed by requests to newly created upload artifacts
Correlate outbound network connections initiated by the PHP worker process with file creation events in the Forminator upload directory

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ to alert on the creation of executable file types
Log and retain full multipart request bodies for the Forminator submission endpoint to support post-incident analysis
Baseline typical Forminator submission volumes and alert on spikes from single source IPs or user agents

How to Mitigate CVE-2026-15748

Immediate Actions Required

Update the Forminator Forms plugin to a version later than 1.56.1 that addresses the handle_file_upload validation flaw
Audit wp-content/uploads/forminator/ for unauthorized executable files and remove any confirmed webshells
Rotate WordPress administrator credentials, database credentials, and API keys if compromise is suspected
Review scheduled tasks (wp_cron), theme files, and plugin files for backdoors added after the earliest suspicious upload timestamp

Patch Information

Refer to the Wordfence Vulnerability Analysis for CVE-2026-15748 for confirmed fixed versions and vendor advisory details. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI. Verify the plugin version after update to confirm the patched release is active.

Workarounds

Disable the Forminator Forms plugin until the patched version is deployed
Remove any public-facing forms that include upload fields to eliminate the exposed attack surface
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level rules
Deploy a web application firewall rule that blocks multipart submissions carrying MIME type values containing the pipe (|) character

bash

# Apache: block PHP execution inside the uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php7|php8)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}