CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCE — Threadlinqs Intelligence
As of 2026-08-17, CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCE is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 9 indicators of compromise.
Threat ID: TL-2026-2052 · Severity: CRITICAL · CVSS: 9.8 · Status: PATCHED · Category: VULNERABILITY
An unauthenticated arbitrary file upload vulnerability (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin (600,000+ active installs) allows attackers to upload executable PHP files
CVE-2026-15748 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Forminator Forms, a contact/payment/custom form-builder plugin for WordPress maintained by WPMU DEV (Incsub) with over 600,000 active installations. The flaw lives in the plugin's handle_file_upload() function and requires no authentication and no user interaction to exploit.
The root cause is twofold, per Wordfence's technical analysis (relayed by The Hacker News and corroborated by German-language outlets blogspan.net and it-boltwise.de): (1) the dangerous-file-extension blocklist performs exact-key string matching that is bypassed by supplying MIME-type keys that use an alternative pipe ('|') separator instead of the expected delimiter, so a crafted key never matches any blocked entry even though the underlying extension is dangerous (e.g. .php) -- effectively a file-type masquerade against the validation logic; and (2) Forminator's public, unauthenticated form-submission handler inherits upload-field configuration from the form submission itself rather than the form's actual server-side-defined configuration, so an attacker can inject a forged Select-field value that redefines which file types the File Upload field will accept. Chained together, an attacker submits a forged form request that overrides the accepted-file-type allowlist, bypasses the blocklist via the MIME-key trick, and uploads an executable .php file directly to the server -- yielding remote code execution and full site takeover.
Exploitation has one structural precondition: the target site must have at least one Forminator form containing both a File Upload field and a Select field, which an attacker must be able to identify (e.g. by fingerprinting the site's Forminator forms/fields) before crafting the forged submission. Given Forminator's popularity as a general-purpose WordPress form builder (contact forms, quote/payment forms, registration forms), this field combination is common in real-world deployments. Default WordPress configurations mitigate impact via a .htaccess file that blocks PHP execution inside the uploads directory -- but per Wordfence's analysis, when a site administrator configures a Custom File Upload Storage root, that protective .htaccess is written on-demand, only during a frontend request that loads the WordPress helper responsible for creating it; if that helper has not yet run, the custom storage path is left unprotected and an uploaded .php file can execute immediately. Sites with custom upload storage paths are therefore fully exposed even where stock installs would be partially shielded.
The vulnerability was discovered and reported by a researcher using the alias 'daroo' and disclosed by Wordfence. The vendor shipped three separate security fixes on the same day (July 30, 2026): 1.56.0.1 (a privilege-escalation fix), 1.56.1 (a stored XSS fix, itself patching a related bug where Forminator_Core::sanitize_array() skipped sanitization for 'select-' prefixed keys and set_field_data() treated a submitted 'return' member as a trusted internal flag -- the same trust-boundary weakness class that CVE-2026-15748 exploits), and 1.56.2 (July 31, 2026), which specifically closes CVE-2026-15748. A further release, 1.57.0 (2026-08-12), bundled additional unspecified 'security improvements' alongside feature work. Public disclosure of the file-upload flaw's technical details followed roughly 18 days after the 1.56.2 patch shipped.
CVE-2026-15748 is not an isolated incident for this plugin: Forminator has a documented recent history of unauthenticated, high-severity flaws. CVE-2025-6463 (CVSS 8.8), patched in version 1.44.3 (June 30, 2025), was an unauthenticated arbitrary file deletion vulnerability via insufficient path validation in entry_delete_upload_files() that could be leveraged toward full site takeover (e.g. by deleting wp-config.php to trigger WordPress's setup wizard). CVE-2026-12998 (CVSS 5.3, CWE-639 Authorization Bypass Through Us
Weaknesses (CWE)
CWE-434, CWE-20, CWE-863
Target sectors: government administration, finance, health, education, technology, ecommerce, news - media, non-profit organisation
Target regions: Global
Timeline
- Forminator 1.44.3 released, patching CVE-2025-6463 (CVSS 8.8, unauthenticated arbitrary file deletion via entry_delete_upload_files()) -- an earlier critical unauthenticated flaw in the same plugin, establishing a recurring vulnerability pattern.
- Forminator 1.56.0.1 released, fixing a related privilege-escalation vulnerability shipped the same day as the file-upload and XSS fixes.
- Forminator 1.56.1 released, fixing an unauthenticated stored XSS via a forged upload record (Select-field sanitization bypass in Forminator_Core::sanitize_array()), the same trust-boundary weakness class later shown to enable CVE-2026-15748.
- Forminator 1.56.2 released, patching CVE-2026-15748 (unauthenticated arbitrary file upload via handle_file_upload()).
- Forminator 1.57.0 released, bundling additional unspecified security improvements.
- CVE-2026-15748 confirmed reserved but not yet published/indexed with full details in the National Vulnerability Database.
- CVE-2026-15748 confirmed absent from the CISA Known Exploited Vulnerabilities catalog (1,666 total entries as of this date), consistent with no confirmed in-the-wild exploitation.
- Wordfence publicly discloses technical details of CVE-2026-15748, crediting researcher 'daroo' with discovery, roughly 18 days after the patch shipped.
- The Hacker News publishes 'Forminator WordPress Flaw Can Enable Full Site Takeover', driving broader security-community awareness.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 9 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-15748, T1592.002, T1588.005, T1190, T1059, T1059.007, T1505.003, T1036.008
