450/69 Wednesday, August 19, 2026
Security researchers have disclosed a Critical vulnerability, CVE-2026-15748, in the Forminator Forms plugin for WordPress, which is installed on more than 600,000 websites. The vulnerability has a CVSS severity score of 9.8 and could allow unauthenticated attackers to upload malicious files, including PHP files, to affected websites, potentially leading to code execution or website takeover.
The vulnerability is caused by insufficient file type validation in the handle_file_upload() function. Attackers could exploit forms that contain both a File Upload field and a Select field to bypass validation and upload specially crafted PHP files. The vulnerability affects Forminator Forms version 1.56.1 and earlier, and has been fixed in version 1.56.2.
Although the default configuration stores uploaded files in a directory containing an .htaccess file to prevent PHP execution, this protection may not apply if administrators configure a custom file upload storage root. In such cases, uploaded PHP files may be executable on the server. Website administrators using Forminator Forms should update to version 1.56.2 or later as soon as possible and review forms that contain both File Upload and Select fields to reduce the risk of exploitation.
Source: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html