CVE-2026-57815: Forminator Path Traversal Vulnerability

CVE-2026-57815 Overview

CVE-2026-57815 is a path traversal vulnerability in the WPMU DEV Forminator plugin for WordPress. The flaw affects Forminator versions up to and including 1.55.0.2 and is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. An unauthenticated remote attacker can traverse the file system and download arbitrary files from the underlying WordPress host. The Patchstack advisory categorizes the issue as an arbitrary file download vulnerability. Forminator is a widely deployed forms, quiz, and polling plugin with active installations across production WordPress sites.

Critical Impact
Unauthenticated attackers can read arbitrary files on the server, including wp-config.php, potentially exposing database credentials, authentication keys, and other sensitive configuration data.

Affected Products

WPMU DEV Forminator WordPress plugin versions up to and including 1.55.0.2
WordPress installations with Forminator enabled and network-accessible
Any hosting environment serving the vulnerable plugin over HTTP or HTTPS

Discovery Timeline

2026-07-13 - CVE-2026-57815 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57815

Vulnerability Analysis

The vulnerability resides in a Forminator request handler that accepts a user-supplied file path parameter and returns file contents in an HTTP response. The handler fails to normalize and validate the requested path against an allow-listed directory. As a result, attackers can inject relative traversal sequences such as ../ to escape the intended download directory. The plugin then reads and returns files located outside the plugin's expected file scope.

The issue is reachable over the network without authentication and without user interaction. Impact is confined to confidentiality — attackers can read files but cannot directly write or execute code through this flaw. Reading wp-config.php typically enables follow-on attacks against the WordPress database, admin accounts, and REST API. Patchstack tracks the issue as an arbitrary file download vulnerability.

Root Cause

The root cause is missing canonicalization and containment checks on a file path parameter passed to a download endpoint. The code does not resolve the requested path with a function such as realpath() and does not verify that the resolved path remains within the plugin's designated storage directory before reading the file.

Attack Vector

An attacker sends an HTTP request to the vulnerable Forminator endpoint with a crafted file path parameter containing directory traversal sequences. The server resolves the traversed path, reads the target file from disk, and returns its contents in the HTTP response body. No credentials, session tokens, or CSRF tokens are required.

See the Patchstack WordPress Vulnerability Advisory for advisory-level technical details.

Detection Methods for CVE-2026-57815

Indicators of Compromise

HTTP requests to Forminator plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in query or POST parameters
Web server access logs showing successful 200 responses to Forminator requests referencing files outside the plugin directory, such as wp-config.php, /etc/passwd, or .env
Unusually large response bodies from Forminator endpoints that normally return small JSON payloads
Requests to Forminator handlers from IPs with no prior interaction with authenticated WordPress functionality

Detection Strategies

Inspect WordPress and reverse-proxy access logs for traversal patterns targeting /wp-content/plugins/forminator/ or Forminator admin-ajax.php and REST routes
Deploy a web application firewall (WAF) rule that blocks decoded ../ sequences in parameters directed at Forminator endpoints
Correlate outbound leakage indicators, such as follow-on database logins from unfamiliar IPs, with prior Forminator download requests

Monitoring Recommendations

Enable verbose HTTP request logging on WordPress front-end servers and retain at least 90 days of history
Alert on any HTTP request whose parameter values contain traversal tokens after URL, double URL, or Unicode decoding
Monitor file access telemetry on the web server process for reads of sensitive files like wp-config.php outside expected maintenance windows

How to Mitigate CVE-2026-57815

Immediate Actions Required

Upgrade Forminator to a version later than 1.55.0.2 as soon as the vendor releases a fixed build
Rotate WordPress database credentials, AUTH_KEY, SECURE_AUTH_KEY, and other secrets in wp-config.php if exposure is suspected
Audit web server logs for prior exploitation attempts and preserve evidence before rotating credentials
Restrict access to the WordPress admin and Forminator endpoints via IP allow-listing where feasible

Patch Information

Refer to the Patchstack WordPress Vulnerability Advisory for the vendor's fixed version and upgrade guidance. Apply the fixed Forminator release through the WordPress plugin manager or by deploying the updated plugin package from the WPMU DEV distribution channel.

Workarounds

Temporarily deactivate the Forminator plugin until a patched version is installed
Add WAF signatures that reject requests containing .., %2e%2e, or %252e%252e sequences in parameters targeting Forminator routes
Enforce filesystem permissions so the PHP worker cannot read files outside the WordPress document root and required system paths

bash

# Example ModSecurity rule to block traversal in Forminator requests
SecRule REQUEST_URI "@contains forminator" \
  "chain,phase:2,deny,status:403,id:1057815,msg:'CVE-2026-57815 Forminator path traversal attempt'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.%2f|%2e%2e/|%252e%252e)" \
    "t:none,t:urlDecodeUni,t:lowercase"