A critical security flaw in Forminator Forms, a WordPress plugin used to build contact forms, surveys, and payment forms, could let an attacker take full control of your site without ever logging in.
What happened
Wordfence found an unauthenticated arbitrary file upload vulnerability in Forminator Forms, tracked as CVE-2026-15748. It scores 9.8 out of 10 on the CVSS severity scale, the top end of the critical range.
The flaw sits in the plugin’s file upload handling. Because the code doesn’t properly check what type of file is being uploaded, an attacker can send a malicious PHP file to a vulnerable site and run it directly on your server. That can lead to complete site compromise: stolen data, defaced pages, or your site turned into a launchpad for further attacks.
A researcher known as “daroo” found and reported the bug through the Wordfence Bug Bounty Program, earning a $2,048 payout.
Who is affected
Forminator Forms is active on more than 600,000 WordPress sites. Every version up to and including 1.56.1 is vulnerable.
The bug only triggers on forms that combine two specific fields: a File Upload field and a Select field. If none of your forms use that combination, you’re not exposed to this particular attack path. But since it’s easy to lose track of exactly which field types are on which forms, especially on sites with many forms or multiple editors, the safest move is to update regardless.
What to do
WPMU DEV, the plugin’s developer, fixed the flaw in version 1.56.2, released July 31, 2026. If you run Forminator Forms, check your installed version now and update immediately if you’re on 1.56.1 or earlier.
If you use the Wordfence firewall, either the free version or a paid tier, you’re already protected against exploit attempts targeting this vulnerability through its built-in malicious file upload protection. That protection is not a substitute for updating the plugin itself.
End of article