# CVE-2026-15748: Forminator WordPress Plugin Arbitrary File Upload Enables Unauthenticated RCE

> An unauthenticated arbitrary file upload vulnerability (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin (600,000+ active installs) allows attackers to upload executable PHP files via the handle_file_upload() function, bypassing its dangerous-extension blocklist using pipe-alternative MIME type keys, leading to remote code execution and complete site compromise. All versions up to and including 1.56.1 are affected; the vendor patched the flaw in version 1.56.2.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2052
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-forminator-unauthenticated-rce-tl-2026-2052.webp?v=bd77729a (Threadlinqs threat intel: CVE-2026-15748 Forminator WordPress RCE: Detection & IOCs (TL-2026-2052) — Critical severity, 9 IOCs, 9 detection rules.)
- **ID:** TL-2026-2052
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 9
- **CVEs:** CVE-2026-15748, CVE-2025-6463, CVE-2026-12998

## Description

CVE-2026-15748 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Forminator Forms, a contact/payment/custom form-builder plugin for WordPress maintained by WPMU DEV (Incsub) with over 600,000 active installations. The flaw lives in the plugin's handle_file_upload() function and requires no authentication and no user interaction to exploit.

The root cause is twofold, per Wordfence's technical analysis (relayed by The Hacker News and corroborated by German-language outlets blogspan.net and it-boltwise.de): (1) the dangerous-file-extension blocklist performs exact-key string matching that is bypassed by supplying MIME-type keys that use an alternative pipe ('|') separator instead of the expected delimiter, so a crafted key never matches any blocked entry even though the underlying extension is dangerous (e.g. .php) -- effectively a file-type masquerade against the validation logic; and (2) Forminator's public, unauthenticated form-submission handler inherits upload-field configuration from the form submission itself rather than the form's actual server-side-defined configuration, so an attacker can inject a forged Select-field value that redefines which file types the File Upload field will accept. Chained together, an attacker submits a forged form request that overrides the accepted-file-type allowlist, bypasses the blocklist via the MIME-key trick, and uploads an executable .php file directly to the server -- yielding remote code execution and full site takeover.

Exploitation has one structural precondition: the target site must have at least one Forminator form containing both a File Upload field and a Select field, which an attacker must be able to identify (e.g. by fingerprinting the site's Forminator forms/fields) before crafting the forged submission. Given Forminator's popularity as a general-purpose WordPress form builder (contact forms, quote/payment forms, registration forms), this field combination is common in real-world deployments. Default WordPress configurations mitigate impact via a .htaccess file that blocks PHP execution inside the uploads directory -- but per Wordfence's analysis, when a site administrator configures a Custom File Upload Storage root, that protective .htaccess is written on-demand, only during a frontend request that loads the WordPress helper responsible for creating it; if that helper has not yet run, the custom storage path is left unprotected and an uploaded .php file can execute immediately. Sites with custom upload storage paths are therefore fully exposed even where stock installs would be partially shielded.

The vulnerability was discovered and reported by a researcher using the alias 'daroo' and disclosed by Wordfence. The vendor shipped three separate security fixes on the same day (July 30, 2026): 1.56.0.1 (a privilege-escalation fix), 1.56.1 (a stored XSS fix, itself patching a related bug where Forminator_Core::sanitize_array() skipped sanitization for 'select-' prefixed keys and set_field_data() treated a submitted 'return' member as a trusted internal flag -- the same trust-boundary weakness class that CVE-2026-15748 exploits), and 1.56.2 (July 31, 2026), which specifically closes CVE-2026-15748. A further release, 1.57.0 (2026-08-12), bundled additional unspecified 'security improvements' alongside feature work. Public disclosure of the file-upload flaw's technical details followed roughly 18 days after the 1.56.2 patch shipped.

CVE-2026-15748 is not an isolated incident for this plugin: Forminator has a documented recent history of unauthenticated, high-severity flaws. CVE-2025-6463 (CVSS 8.8), patched in version 1.44.3 (June 30, 2025), was an unauthenticated arbitrary file deletion vulnerability via insufficient path validation in entry_delete_upload_files() that could be leveraged toward full site takeover (e.g. by deleting wp-config.php to trigger WordPress's setup wizard). CVE-2026-12998 (CVSS 5.3, CWE-639 Authorization Bypass Through User-Controlled Key), affecting versions up to and including 1.55.0.2, is an IDOR that lets unauthenticated attackers enumerate sequential draft-entry IDs via the 'draft' parameter and read other users' saved draft form data (names, emails, addresses) when the 'Save and Continue' feature is enabled. Together with CVE-2026-15748, this establishes a recurring pattern of insufficiently-validated user input across Forminator's form-submission and file-handling code paths.

As of this writing there is no confirmed in-the-wild exploitation and the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog (verified against the current KEV feed, 1,666 entries as of 2026-08-17); NVD had not yet indexed/published the CVE record (status: reserved/pending) at time of research. Wordfence's public technical writeup discloses enough mechanism-level detail (the specific vulnerable function, the exact blocklist-bypass technique, and the trust-boundary flaw in the submission handler) that a capable attacker could reproduce a working exploit without a published PoC script, which elevates near-term risk for the large unpatched installed base.

## MITRE ATT&CK

- T1592.002 Software
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.007 JavaScript
- T1505.003 Web Shell
- T1036.008 Masquerade File Type

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Forminator Forged Select-Field Upload Blocklist Bypass — SPL** (`TL-2026-2052-SPL-001`)

Detects unauthenticated POST requests to Forminator's WordPress form-submission endpoint (admin-ajax.php action=forminator_submit_form / wp-json/forminator) that carry a forged Select-field upload-configuration override combined with a pipe-delimited MIME-type key, the exact chain CVE-2026-15748 uses to bypass the dangerous-extension blocklist in handle_file_upload() and smuggle an executable .php file past validation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1036.008, T1211, T1592.002
- **Data sources:** web_server_access_log (Apache/Nginx combined), IIS W3C extended log, Wordfence WAF log
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=access_combined (uri_path="*/wp-admin/admin-ajax.php*" OR uri_path="*/wp-json/forminator*")
(form_data="*action=forminator_submit_form*" OR form_data="*forminator_form_id*")
| eval mime_key=coalesce(post_field_key, form_data)
| eval pipe_mime_bypass=if(match(mime_key, "\|"), 1, 0)
| eval php_upload_attempt=if(match(form_data, "(?i)\.php"), 1, 0)
| eval select_override=if(match(form_data, "(?i)select-[0-9]+.*(upload|file[-_]?type)"), 1, 0)
| where pipe_mime_bypass=1 OR php_upload_attempt=1 OR select_override=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip, http_method, pipe_mime_bypass, php_upload_attempt, select_override
| where select_override=1 OR (pipe_mime_bypass=1 AND php_upload_attempt=1) OR count > 3
| sort -count
```

### Microsoft KQL

```kql
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has_any ("admin-ajax.php", "wp-json/forminator")
| where csUriQuery has "forminator_submit_form" or csUriQuery has "forminator_form_id"
| extend PipeMimeBypass = csUriQuery matches regex @"[^&=]+\|[^&=]*=(image|application)/"
| extend PhpUploadAttempt = csUriQuery matches regex @"(?i)\.php"
| extend SelectOverride = csUriQuery matches regex @"(?i)select-[0-9]+.*(upload|file[-_]?type)"
| where PipeMimeBypass or PhpUploadAttempt or SelectOverride
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Endpoints = make_set(csUriStem) by cIP, csMethod, PipeMimeBypass, PhpUploadAttempt, SelectOverride
| where SelectOverride == true or (PipeMimeBypass == true and PhpUploadAttempt == true) or RequestCount > 3
| project cIP, csMethod, Endpoints, RequestCount, FirstSeen, LastSeen, PipeMimeBypass, PhpUploadAttempt, SelectOverride
```

### Sigma

```yaml
title: Forminator Forged Select-Field File Upload Blocklist Bypass (CVE-2026-15748)
id: 7a1c2e4d-3f5b-4a6e-9c2d-1e8f6b4a7c01
status: experimental
description: Detects unauthenticated POST requests to Forminator's WordPress form-submission endpoint containing a forged Select-field upload-configuration override and/or a pipe-delimited MIME-type key, used to bypass the plugin's dangerous-extension blocklist and upload an executable PHP file (CVE-2026-15748).
references:
    - https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/forminator
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-17
tags:
    - attack.initial-access
    - attack.t1190
    - attack.defense-evasion
    - attack.t1036.008
    - attack.reconnaissance
    - attack.t1592.002
    - cve.2026.15748
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-stem|contains:
            - '/wp-admin/admin-ajax.php'
            - '/wp-json/forminator'
    selection_action:
        cs-uri-query|contains:
            - 'forminator_submit_form'
            - 'forminator_form_id'
    selection_bypass:
        cs-uri-query|contains: '|'
    selection_php:
        cs-uri-query|contains|re: '(?i)\.php'
    selection_select_override:
        cs-uri-query|contains|re: '(?i)select-[0-9]+.*(upload|file[-_]?type)'
    condition: selection_endpoint and selection_action and (selection_bypass or selection_php or selection_select_override)
falsepositives:
    - Legitimate automated form-testing/QA tools submitting Forminator forms with pipe characters in free-text answer fields
    - Third-party integrations that programmatically POST to admin-ajax.php with forminator_form_id for legitimate automation
level: high
```

**Known false positives:**

- Legitimate automated form-testing/QA tools submitting Forminator forms with pipe characters in free-text answer fields
- Third-party integrations that programmatically POST to admin-ajax.php with forminator_form_id for legitimate automation

**Tuning notes:** Scope the src_ip/cIP aggregation to the site's actual Forminator form endpoints; allowlist known QA/automation source IPs; if the site legitimately uses pipe-delimited custom field values, require the select_override or php_upload_attempt signal (not the pipe-key signal alone) before alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] Forged Select-Field Upload Blocklist Bypass — KQL (locked: unlock with TL Creds)
- PHP-to-Shell Process Chain From WordPress Uploads Path — KQL (locked: unlock with TL Creds)
- Post-Compromise Webshell Interaction and Outbound Tool Transfer — KQL (locked: unlock with TL Creds)
- [indicator] Forged Select-Field Upload Blocklist Bypass — Sigma (locked: unlock with TL Creds)
- PHP-to-Shell Process Chain From WordPress Uploads Path — Sigma (locked: unlock with TL Creds)
- Post-Compromise Webshell Interaction and Outbound Tool Transfer — Sigma (locked: unlock with TL Creds)
- PHP-to-Shell Process Chain From WordPress Uploads Path — SPL (locked: unlock with TL Creds)
- Post-Compromise Webshell Interaction and Outbound Tool Transfer — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Forminator WordPress Flaw Can Enable Full Site Takeover](https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html)
- [Forminator: Kritische Lücke erlaubte Upload ohne Anmeldung](https://www.blogspan.net/forminator-wordpress-luecke-datei-upload/)
- [Forminator und User Profile Builder: kritische WordPress-RCE- und Auth-Lücken](https://www.it-boltwise.de/forminator-und-user-profile-builder-kritische-wordpress-rce-und-auth-luecken.html)
- [Forminator plugin changelog (WordPress.org)](https://wordpress.org/plugins/forminator/#developers)
- [CVE-2026-15748 Detail (reserved, not yet published)](https://nvd.nist.gov/vuln/detail/CVE-2026-15748)
- [Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Wordfence Vulnerability Database](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/forminator)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-15748 absent, verified)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CVE-2025-6463: Unauthenticated Arbitrary File Deletion in Forminator Plugin Exposes Over 600,000 WordPress Sites to Remote Takeover](https://securityonline.info/cve-2025-6463-unauthenticated-arbitrary-file-deletion-in-forminator-plugin-exposes-over-600000-wordpress-sites-to-remote-takeover/)
- [CVE-2026-12998: CWE-639 Authorization Bypass Through User-Controlled Key in wpmudev Forminator Forms](https://radar.offseq.com/threat/cve-2026-12998-cwe-639-authorization-bypass-through-user-controlled-key-in-wpmudev-forminator-forms-2af7619115fe2cb0)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2052