CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCE

CVE-2026-15748 (TL-2026-2052) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-08-17. It has no confirmed attribution, affects WPMU DEV (Incsub) Forminator Forms – Contact Form, Payment Form &, references 1 CVE (CVE-2026-15748), maps to 7 MITRE ATT&CK techniques (T1036.008, T1059, T1059.007), and is covered by 9 detection rules and 9 indicators of compromise.

Key facts for TL-2026-2052

Threat ID
TL-2026-2052
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-17
Last reviewed
2026-08-17
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, education, technology, ecommerce, news - media, non-profit organisation
Target regions
Global
Detection rules
9
Indicators of compromise
9

An unauthenticated arbitrary file upload vulnerability (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin (600,000+ active installs) allows attackers to upload executable PHP files via the handle_file_upload() function, bypassing its dangerous-extension blocklist using pipe-alternative MIME type keys, leading to remote code execution and complete site compromise. All versions up to and including 1.56.1 are affected; the vendor patched the flaw in version 1.56.2.

How CVE-2026-15748 works

CVE-2026-15748 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Forminator Forms, a contact/payment/custom form-builder plugin for WordPress maintained by WPMU DEV (Incsub) with over 600,000 active installations. The flaw lives in the plugin's handle_file_upload() function and requires no authentication and no user interaction to exploit.

The root cause is twofold, per Wordfence's technical analysis (relayed by The Hacker News and corroborated by German-language outlets blogspan.net and it-boltwise.de): (1) the dangerous-file-extension blocklist performs exact-key string matching that is bypassed by supplying MIME-type keys that use an alternative pipe ('|') separator instead of the expected delimiter, so a crafted key never matches any blocked entry even though the underlying extension is dangerous (e.g. .php) -- effectively a file-type masquerade against the validation logic; and (2) Forminator's public, unauthenticated form-submission handler inherits upload-field configuration from the form submission itself rather than the form's actual server-side-defined configuration, so an attacker can inject a forged Select-field value that redefines which file types the File Upload field will accept. Chained together, an attacker submits a forged form request that overrides the accepted-file-type allowlist, bypasses the blocklist via the MIME-key trick, and uploads an executable .php file directly to the server -- yielding remote code execution and full site takeover.

Exploitation has one structural precondition: the target site must have at least one Forminator form containing both a File Upload field and a Select field, which an attacker must be able to identify (e.g. by fingerprinting the site's Forminator forms/fields) before crafting the forged submission. Given Forminator's popularity as a general-purpose WordPress form builder (contact forms, quote/payment forms, registration forms), this field combination is common in real-world deployments. Default WordPress configurations mitigate impact via a .htaccess file that blocks PHP execution inside the uploads directory -- but per Wordfence's analysis, when a site administrator configures a Custom File Upload Storage root, that protective .htaccess is written on-demand, only during a frontend request that loads the WordPress helper responsible for creating it; if that helper has not yet run, the custom storage path is left unprotected and an uploaded .php file can execute immediately. Sites with custom upload storage paths are therefore fully exposed even where stock installs would be partially shielded.

The vulnerability was discovered and reported by a researcher using the alias 'daroo' and disclosed by Wordfence. The vendor shipped three separate security fixes on the same day (July 30, 2026): 1.56.0.1 (a privilege-escalation fix), 1.56.1 (a stored XSS fix, itself patching a related bug where Forminator_Core::sanitize_array() skipped sanitization for 'select-' prefixed keys and set_field_data() treated a submitted 'return' member as a trusted internal flag -- the same trust-boundary weakness class that CVE-2026-15748 exploits), and 1.56.2 (July 31, 2026), which specifically closes CVE-2026-15748. A further release, 1.57.0 (2026-08-12), bundled additional unspecified 'security improvements' alongside feature work. Public disclosure of the file-upload flaw's technical details followed roughly 18 days after the 1.56.2 patch shipped.

CVE-2026-15748 is not an isolated incident for this plugin: Forminator has a documented recent history of unauthenticated, high-severity flaws. CVE-2025-6463 (CVSS 8.8), patched in version 1.44.3 (June 30, 2025), was an unauthenticated arbitrary file deletion vulnerability via insufficient path validation in entry_delete_upload_files() that could be leveraged toward full site takeover (e.g. by deleting wp-config.php to trigger WordPress's setup wizard). CVE-2026-12998 (CVSS 5.3, CWE-639 Authorization Bypass Through User-Controlled Key), affecting versions up to and including 1.55.0.2, is an IDOR that lets unauthenticated attackers enumerate sequential draft-entry IDs via the 'draft' parameter and read other users' saved draft form data (names, emails, addresses) when the 'Save and Continue' feature is enabled. Together with CVE-2026-15748, this establishes a recurring pattern of insufficiently-validated user input across Forminator's form-submission and file-handling code paths.

As of this writing there is no confirmed in-the-wild exploitation and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog (verified against the current KEV feed, 1,666 entries as of 2026-08-17); NVD had not yet indexed/published the CVE record (status: reserved/pending) at time of research. Wordfence's public technical writeup discloses enough mechanism-level detail (the specific vulnerable function, the exact blocklist-bypass technique, and the trust-boundary flaw in the submission handler) that a capable attacker could reproduce a working exploit without a published PoC script, which elevates near-term risk for the large unpatched installed base.

MITRE ATT&CK techniques used in TL-2026-2052

Defense Evasion

T1036.008 Masquerade File Type

Execution

T1059 Command and Scripting Interpreter; T1059.007 JavaScript

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Web Shell

Resource Development

T1588.005 Exploits

Reconnaissance

T1592.002 Software

Affected products and versions in CVE-2026-15748

  • WPMU DEV (Incsub) — Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress plugin)
    Vulnerable versions: <= 1.56.1
    Fixed in: 1.56.2; 1.57.0

Remediation for CVE-2026-15748

Patches

  • Forminator 1.56.2 (fixes CVE-2026-15748 arbitrary file upload)
  • Forminator 1.56.1 (fixes a related unauthenticated stored XSS via forged upload record)
  • Forminator 1.56.0.1 (fixes a related privilege-escalation issue)
  • Forminator 1.57.0 (bundles further unspecified security improvements)
  • Forminator 1.44.3 (fixes CVE-2025-6463 arbitrary file deletion, an earlier related unauthenticated vulnerability)

Immediate actions

  • Update Forminator Forms to version 1.56.2 or later (1.57.0 is current) immediately across all sites
  • Audit all Forminator forms for the presence of both a File Upload field and a Select field; disable or restrict such forms until patched
  • Scan the uploads directory and any custom upload storage paths for unexpected .php or other executable files uploaded via Forminator
  • Review web server logs for POST requests to Forminator's public form-submission endpoints containing anomalous Select-field or upload-field-configuration parameters

Workarounds

  • If immediate patching is not possible, temporarily remove or disable any Forminator form combining a File Upload field with a Select field
  • Block PHP execution in the WordPress uploads directory at the web-server level as a compensating control
  • Disable the 'Save and Continue' draft feature if not required, reducing exposure to the related draft-enumeration IDOR (CVE-2026-12998)

Longer-term hardening

  • Enforce .htaccess / web-server rules that deny PHP execution inside all upload directories, including any custom upload paths configured for Forminator, and verify the deny rule is present at provisioning time rather than relying on on-demand creation
  • Deploy a WAF rule set (e.g. Wordfence's Malicious File Upload firewall rule) to catch blocklist-bypass patterns such as pipe-delimited MIME-type keys
  • Adopt a policy of prompt patching for form-builder and file-upload-capable plugins given their recurring history as an RCE vector on WordPress
  • Enable file-integrity monitoring on wp-content/uploads and plugin directories to catch webshell drops
  • Monitor Forminator security advisories going forward given the plugin's recurring history of unauthenticated vulnerabilities (CVE-2025-6463 file deletion, CVE-2026-12998 IDOR, CVE-2026-15748 RCE) and apply updates promptly

CVEs associated with CVE-2026-15748

CVE-2026-15748

Weaknesses (CWE) in CVE-2026-15748

CWE-434, CWE-20, CWE-863

Timeline of CVE-2026-15748

  • Forminator 1.44.3 released, patching CVE-2025-6463 (CVSS 8.8, unauthenticated arbitrary file deletion via entry_delete_upload_files()) -- an earlier critical unauthenticated flaw in the same plugin, establishing a recurring vulnerability pattern.
  • Forminator 1.56.1 released, fixing an unauthenticated stored XSS via a forged upload record (Select-field sanitization bypass in Forminator_Core::sanitize_array()), the same trust-boundary weakness class later shown to enable CVE-2026-15748.
  • Forminator 1.56.0.1 released, fixing a related privilege-escalation vulnerability shipped the same day as the file-upload and XSS fixes.
  • Forminator 1.56.2 released, patching CVE-2026-15748 (unauthenticated arbitrary file upload via handle_file_upload()).
  • Forminator 1.57.0 released, bundling additional unspecified security improvements.
  • The Hacker News publishes 'Forminator WordPress Flaw Can Enable Full Site Takeover', driving broader security-community awareness.
  • Wordfence publicly discloses technical details of CVE-2026-15748, crediting researcher 'daroo' with discovery, roughly 18 days after the patch shipped.
  • CVE-2026-15748 confirmed absent from the CISA Known Exploited Vulnerabilities catalog (1,666 total entries as of this date), consistent with no confirmed in-the-wild exploitation.
  • CVE-2026-15748 confirmed reserved but not yet published/indexed with full details in the National Vulnerability Database.

Sources cited for CVE-2026-15748

Threats related to CVE-2026-15748

Detection coverage for TL-2026-2052

As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2052 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats