Severe Vulnerability Revealed in Forminator Forms Plugin
A significant security breach has come to light pertaining to Forminator Forms, a WordPress plugin boasting over 600,000 active deployments. This flaw presents an opportunity for malicious actors to execute arbitrary code on compromised sites.
The vulnerability, designated as CVE-2026-15748, receives a critical rating of 9.8 out of 10.0 within the CVSS scoring framework.
Discovered by a cybersecurity investigator known by the moniker “daroo,” the discovery underscores critical risks for website administrators.
According to a report issued by Wordfence, “This vulnerability enables unauthenticated assailants to upload arbitrary files, encompassing executable PHP scripts, to a vulnerable site, potentially culminating in remote code execution and total site compromise.”
Importantly, successful exploitation depends on the presence of a form featuring both a File Upload field and a Select field.
This vulnerability affects all iterations of the plugin up to and including version 1.56.1. The issue has been rectified in version 1.56.2, released on July 31, 2026.
Wordfence indicates that this vulnerability arises from a deficiency in file type validation within the “handle_file_upload()” function.
Consequently, an unauthenticated intruder can exploit this weakness to upload any file, including a specifically tailored PHP file, by submitting a form, thereby gaining remote code execution. Such access empowers the attacker to seize control of the entire website.
“The problem persists due to flawed file type validation in handle_file_upload; the hazardous-extension blocklist conducts exact-key matching that can be circumvented through the use of pipe-alternative MIME type keys, compounded by a public submission handler that unwittingly accepts attacker-controlled upload field configuration via a forged Select field value,” stated Wordfence.
Moreover, it is crucial to note that, in its default state, uploaded files are stored in a directory fortified by an .htaccess file that precludes PHP execution.
However, if a site administrator elects to configure a Custom File Upload Storage root, it may lack the same protections, as the file is created “only when first invoked, during a frontend request where the WordPress mechanism responsible for establishing the .htaccess file is not invoked.”
As a result, requesting the uploaded file can instigate the web server to execute PHP code under the attacker’s control.
Authentication Bypass Vulnerability in User Profile Builder Plugin
This revelation arrives shortly after Wordfence disclosed another grave authentication bypass vulnerability within the User Profile Builder, a plugin featuring over 40,000 active WordPress installations.
This flaw could enable unauthenticated intruders to log in as user ID 1 (typically the site administrator), thereby facilitating complete site takeover.
The vulnerability, cataloged as CVE-2026-15826 (CVSS score: 9.8), received a patch on July 16, 2026, with the release of version 3.16.5.
All previous iterations are susceptible to this issue, yet exploitation is contingent upon the plugin’s Automatically Log In setting being enabled.
This stems from the wppb_log_in_user() function invoking absint() on the return value of wp_insert_user() prior to conducting an is_wp_error() check.
When a registration is submitted with a username consisting of 61–70 characters, WordPress core denies it, yielding a WP_Error object; however, absint() coerces that object to the integer 1 before the error check can intercept execution, leading the plugin to bind and deliver a transient-backed autologin nonce associated with user ID 1, as elaborated by Wordfence.
“This vulnerability permits unauthenticated attackers to gain access to the site’s Administrator account (user ID 1), resulting in total administrative control over the site.”
Website proprietors utilizing either of the affected plugins are strongly urged to implement the necessary updates promptly, ensuring their installations are current.
Source link: Thehackernews.com.
