Security researchers have disclosed a critical vulnerability in the Forminator Forms WordPress plugin that could let unauthenticated attackers upload arbitrary files, including PHP, to affected sites. The issue affects versions up to and including 1.56.1 of the plugin, which has more than 600,000 active installations, and can lead to remote code execution and full site compromise on vulnerable setups.
Forminator Forms flaw opens the door to arbitrary file uploads
The vulnerability was reported to Wordfence on July 14, 2026, after being submitted through the Wordfence Bug Bounty Program. Wordfence says the bug is tracked as CVE-2026-15748 and carries a CVSS score of 9.8, placing it in the critical range.
According to the disclosure, the flaw exists in Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] and affects all versions through 1.56.1. The patched release is version 1.56.2, which the developer released on July 31, 2026.
How the Forminator Forms vulnerability can be triggered
The issue is not universally exploitable on every form. Wordfence says the attack only works on sites where a published form contains both a File Upload field and a Select field. That combination allows an attacker to use the Select field as a vehicle for forged configuration data.
In the reported attack path, the plugin’s request handling can preserve nested field data from select-style fields and later trust that data during upload processing. Once a real File Upload field is present, the plugin iterates through the stored field data and can treat the forged entry as a legitimate upload configuration.
From there, an attacker can influence the upload settings passed into the file-handling logic, including the allowed file types. Wordfence says this happens because the upload code relies on attacker-controlled field configuration after the forged record is injected.
Why the extension checks fail
Forminator tries to block dangerous file types through a list of disallowed extensions. But the vulnerability bypasses that protection because the blocklist performs exact-key matching. In the report, Wordfence explains that a literal php entry is removed, but a pattern such as ph(p) is not.
That matters because WordPress’s file-type matching can still interpret the pattern as matching a .php file. Combined with a MIME mapping such as ph(p)|text/x-php, the validation logic can be tricked into accepting a PHP upload.
In other words, the attack is not just about sneaking in a file with a suspicious name. It combines forged form data, upload-handler trust issues, and a bypass of the plugin’s dangerous-extension filtering.
What an attacker could gain
If the exploit succeeds, the attacker can upload a PHP file to the server. On a site where that file is reachable and executable, this can enable remote code execution, often through a web shell or similar payload.
Wordfence notes that the risk is especially serious when an administrator has configured a custom file upload storage root. In that scenario, the usual .htaccess protection may not be present because the directory is created only when first needed during a frontend request, and the WordPress helper that writes the protective file may not be loaded at that point.
For site owners, that means the same uploaded file that might otherwise sit harmlessly on disk can become executable if the storage location is not protected as expected.
Who is protected and what site owners should do
Wordfence says all of its users are protected against exploitation attempts targeting this flaw through the firewall’s built-in Malicious File Upload protection. That includes Wordfence Premium, Wordfence Care, Wordfence Response, and sites running the free version of Wordfence.
Even with firewall protection in place, Wordfence is urging users to update Forminator Forms immediately. The company says the latest patched release at publication time is version 1.56.2.
For WordPress administrators, the practical checklist is straightforward:
- Confirm whether Forminator Forms is installed and active.
- Check that the plugin version is 1.56.2 or newer.
- Review forms that include both File Upload and Select fields.
- Inspect any custom upload storage roots for proper server-side protection.
- Keep security tooling enabled and up to date.
Timeline: report, validation, patch
Wordfence provided a disclosure timeline showing a quick response from both the researcher and the vendor. The company says it received the submission on July 11, 2026, validated the issue on July 14, and sent full disclosure details to the Forminator team the same day through its vulnerability management portal.
The developer acknowledged the report on July 20, 2026, and released the fully patched version on July 31, 2026. Wordfence publicly praised the Forminator team for what it described as a prompt response and timely fix.
A reminder about form plugins and attack surface
Form builder plugins are widely used because they make it easy to add contact, payment, quiz, and file-upload features to WordPress sites. That convenience also makes them attractive targets, especially when multiple field types interact in unexpected ways.
This case is a useful reminder that security problems often emerge from combinations of small assumptions: a request parser that preserves nested data, an upload routine that trusts field configuration, and a filename filter that blocks only exact string matches. Together, those pieces created a path to arbitrary file upload on a large number of WordPress sites.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More Cybersecurity Tech News
Last Modified: August 18, 2026 at 1:53 am
1 views
