Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Forminator Forms arbitrary file upload flaw (CVE-2026-15748)

Vulnerability
First reported
Last updated
Happening score
H score 18
1 unique sources, 1 articles

Summary

Hide ▲

CVE-2026-15748 affects Forminator Forms for WordPress, exposing more than 600,000 active installations to unauthenticated arbitrary file upload and potential remote code execution. The flaw can lead to complete site compromise on susceptible sites that meet the plugin’s form-field preconditions. Version 1.56.2 addresses the issue, and sites running 1.56.1 or earlier are affected.

Related Happenings

User Profile Builder authentication bypass (CVE-2026-15826)

Vulnerability
H score58 First: 17.08.2026 16:30 Last: 17.08.2026 16:30 Sources 1

How related: The disclosure comes days after Wordfence also highlighted another critical authentication bypass bug in User Profile Builder, which has more than 40,000 active WordPress installations, that could allow unauthenticated attackers to log in as the user with ID 1 (typically the site administrator) and take over the site.

About this happening: More than 40,000 WordPress sites are exposed to CVE-2026-15826 in User Profile Builder, an authentication bypass that can let unauthenticated attackers obtain an a...

Open Happening

Timeline

  1. 17.08.2026 21:22 1 articles · 4h ago

    Version 1.56.2 fixes Forminator Forms file upload flaw

    Mitigation Patch Update

    Version 1.56.2 released on July 31, 2026 addresses CVE-2026-15748 in Forminator Forms for WordPress, covering all versions before and including 1.56.1. Wordfence said the flaw stems from insufficient file type validation in handle_file_upload(), and sites using a Custom File Upload Storage root may not inherit the default .htaccess protection that blocks PHP execution.

    Show sources
    Open in new tab
  2. 17.08.2026 21:22 2 articles · 4h ago

    CVE-2026-15748 exposes Forminator Forms sites to remote code execution

    Initial Disclosure

    Wordfence disclosed a critical arbitrary file upload flaw in Forminator Forms for WordPress, tracked as CVE-2026-15748 and rated CVSS 9.8, affecting more than 600,000 active installations. On sites with both a File Upload field and a Select field, unauthenticated attackers can upload arbitrary files including executable PHP files through handle_file_upload(), which can lead to remote code execution and complete site compromise.

    Show sources
    Open in new tab