Critical Security Vulnerability in Forminator Forms Plugin
A severe security vulnerability has been identified in the Forminator Forms plugin for WordPress, potentially allowing unauthenticated attackers to upload malicious PHP files. This egregious flaw could grant full administrative control over compromised websites.
Designated as CVE-2026-15748, this vulnerability impacts versions 1.56.1 and earlier of Forminator Forms, which carries a daunting CVSS severity rating of 9.8.
Forminator Forms is a heavily utilized drag-and-drop plugin, enabling users to create various forms such as contact, payment, polls, quizzes, and file uploads.
With an active user base exceeding 600,000 installations, the risk presented by this vulnerability is substantial for WordPress administrators who have yet to implement the necessary updates.
Details of the WordPress Plugin Vulnerability
The vulnerability was unearthed by security researcher daroo through the Wordfence bug bounty program, for which he received a reward of $2,048.
On July 14, 2026, Wordfence confirmed the exploit and promptly alerted the Forminator development team. Subsequently, a patch was released in version 1.56.2 on July 31, 2026.
The flaw pertains to Forminator’s handling of file uploads, permitting attackers to introduce a falsified upload configuration via the Select field within vulnerable forms.
During the upload process, Forminator erroneously accepts user-defined parameters such as the upload field name, field type, and file-handling specifications.
An attacker’s malicious request can manipulate this process, leading the plugin to treat the forged data as authentic upload configurations.
This exploit circumvents the plugin’s filtration mechanisms designed to prevent the upload of dangerous file extensions.
Although Forminator employs a blocklist to thwart .php and other executable file types, the blocklist utilizes precise matches against file-extension keys.
Research reveals that an attacker could employ the obfuscation technique ph(p) instead of the outright blocked php extension.
WordPress recognizes ph(p) as corresponding to a .php file extension, yet Forminator’s blocklist inadvertently allows it through.
By synergizing this forged configuration with a MIME type like text/x-php, an attacker may successfully upload a PHP payload that circumvents validation protocols.
Typically, uploaded files are deposited into a directory fortified by an .htaccess rule, which precludes PHP execution. However, instances where a custom file-upload storage location is utilized may lack this protective measure.
In scenarios where the uploaded PHP file resides in an executable and web-accessible directory, attackers may directly access it, executing arbitrary commands on the server.
The ramifications of successful exploitation are severe, potentially culminating in remote code execution, the deployment of webshells, theft of WordPress credentials, unauthorized database access, malware installation, or complete site takeover.
Consequently, it is imperative for site owners to upgrade Forminator Forms to version 1.56.2 or later without delay.
Administrators are also advised to scrutinize current form configurations, examine upload directories for any suspicious PHP files, and ensure that uploaded files are incapable of executing as server-side code.
Source link: Cybersecuritynews.com.
