300,000 WordPress sites exposed by Forminator file-upload bug

A critical vulnerability in the Forminator Forms plugin for WordPress allows unauthenticated attackers to upload executable files and run code on affected sites. The issue is tracked as CVE-2026-15748 with a CVSS score of 9.8 and was fixed in Forminator version 1.56.2, released on July 31. All releases up to 1.56.1 are affected.

Security firm Defiant reported the flaw and attributed it to insufficient file type validation in the plugin’s handle_file_upload function. Attackers can combine weaknesses to forge a form record using a Select field, alter the upload field configuration that the public submission handler accepts, and bypass the plugin’s blocklist for dangerous file types.

Bypassing the blocklist is possible because the plugin’s dangerous-extension list uses exact-key matching that can be evaded with pipe-alternative MIME type keys, according to Defiant. In default installations, uploaded files are stored in a protected directory that blocks PHP execution, reducing the immediate risk of remote code execution.

Sites that use a Custom File Upload Storage root do not receive those protections. In those configurations, an attacker-supplied PHP file placed by the vulnerable upload routine will execute when the uploaded file is requested directly, enabling installation of a webshell and full site compromise.

Forminator has more than 600,000 active installations. WordPress telemetry indicates roughly half of those installations run a version earlier than 1.56.2, leaving more than 300,000 sites potentially exposed to the vulnerability. Defiant reports no confirmed exploitation in the wild so far.

Site administrators running affected versions are advised to update to Forminator 1.56.2, released July 31, to apply the vendor patch that corrects the file-upload handling.

Defiant offered technical detail on the flaw: “This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value.” A further warning from the firm noted: “As with all arbitrary file upload vulnerabilities, this can lead to complete site compromise through the use of webshells and other techniques.”