A recently reported weakness in the Forminator Forms WordPress plugin has security experts warning that a large number of websites may be exposed to Forminator Forms RCE (remote code execution) attacks. Defiant, a WordPress security firm, describes the flaw as critical, with a CVSS score of 9.8.
The good news: the plugin maintainers released a fix. The important part for site owners is timing—if you’re running an older version, you should update promptly to reduce the risk of compromise.
What the Forminator Forms vulnerability enables
Defiant reports that the issue is tracked as CVE-2026-15748. At its core, the problem involves arbitrary file upload through the plugin’s file handling logic—specifically the handle_file_upload function.
In plain terms, the vulnerability centers on how uploaded files are validated. The security report indicates that insufficient file type validation allows attackers who are not authenticated to upload executable files. Once an executable file lands in the right place, it can lead to code execution on the affected server.
How the attack works, step by step
Defiant explains that the real danger isn’t just one bug—it’s a chain of weaknesses that can be combined. The company highlights several elements that, together, help an attacker craft a reliable exploit path.
According to Defiant, the attacker can:
- Forge records using the Select field on a form.
- Influence the field configuration that gets passed into the upload function, by controlling values that are injected via the forged Select field.
- Bypass the plugin’s blocklist of dangerous file types.
One key part of the bypass relates to how the plugin checks file extensions. Defiant notes that the dangerous-extension blocklist relies on exact-key matching. Attackers can get around this by using pipe-alternative MIME type keys, which the blocklist does not catch in the same way.
In addition, the upload path involves a public submission handler that trusts attacker-controlled upload field configuration. That trust makes it possible for malicious upload parameters to reach the vulnerable file handling code path.
Why the impact can vary by configuration
Not every site is equally at risk in every setup. Defiant points out that, in default configurations, uploaded files are placed in a protected directory designed to prevent PHP execution.
However, the protection may not apply if a site owner configured a custom storage location. Specifically, Defiant states that if a Custom File Upload Storage root has been set, the usual protection may not be applied there. In that scenario, the attacker-supplied PHP code can be executed when the uploaded file is requested directly.
As with other arbitrary file upload problems, the report emphasizes the possibility of complete site compromise. That could be done through webshells and other techniques once code execution is achieved.
Affected versions and the available patch
Defiant reports that the vulnerability impacts all Forminator Forms versions up to 1.56.1. The issue is addressed in Forminator Forms 1.56.2.
The fixed release was published on July 31, so the most practical action for administrators is to check your current version and upgrade immediately if you are on an earlier build.
How widespread the risk appears to be
The potential exposure is significant. The Forminator Forms plugin has over 600,000 installations, and Defiant references WordPress data suggesting that half of those sites run a vulnerable version.
That implies that over 300,000 websites may be potentially exposed to attacks related to this vulnerability. Importantly, Defiant notes that there are currently no reports of exploitation “in the wild,” meaning public, confirmed attacks leveraging this specific issue have not been observed so far.
What administrators should do now
If you manage a WordPress site that uses Forminator Forms, the safest move is straightforward: update to 1.56.2 or later as soon as possible.
Beyond updating, consider a quick risk check of your environment:
- Verify your plugin version from the WordPress admin area or via your deployment logs.
- Review any custom upload storage settings, especially a custom “root” location where uploaded files might be placed.
- Check for unexpected uploaded files around the time you last updated (or if you suspect suspicious form activity).
- Harden your overall WordPress security with least-privilege access, strong admin credentials, and reliable monitoring.
If your site has strict compliance requirements or you can’t update immediately, treat this vulnerability as high priority. Even before any public exploitation is confirmed, the severity rating and the described exploit chain make it a risk worth addressing right away.
Related vulnerability context
While this article focuses on Forminator Forms, the broader security landscape continues to show critical issues across widely used platforms. Recent advisories have also referenced patches for code injection and other critical problems in different systems. The pattern reinforces a common takeaway: timely patching is one of the most effective ways to limit the blast radius of newly disclosed vulnerabilities.
Bottom line
The reported Forminator Forms RCE issue (CVE-2026-15748) is serious because it combines file upload weaknesses with validation bypasses and attacker-controlled parameters. For sites running plugin versions up to 1.56.1, the potential outcome includes remote code execution—and in some configurations, this could lead to full compromise.
Fortunately, a fix is available in Forminator Forms 1.56.2. If you want to reduce risk, updating now is the most direct and effective step.
