Forminator Vulnerability CVE-2026-15748: Patch Now

Last updated: August 21, 2026

The Forminator vulnerability CVE-2026-15748 is a critical unauthenticated arbitrary file upload flaw rated CVSS 9.8. It affects Forminator Forms up to and including version 1.56.1 and was fixed in 1.56.2, released July 31, 2026. Roughly 300,000 of the plugin’s 600,000+ installs were still running vulnerable versions.

What is the Forminator vulnerability CVE-2026-15748?

It is a flaw in Forminator’s handle_file_upload function that fails to validate file types properly, letting an unauthenticated attacker upload executable files to the server. Where the site stores uploads outside the plugin’s default protected location, that upload becomes remote code execution and full site compromise.

Forminator Forms is developed by WPMU DEV and is one of the most widely deployed form builders on WordPress. The flaw was discovered by Defiant, the security firm behind Wordfence, and disclosed publicly in August 2026.

Detail	Value
CVE	CVE-2026-15748
CVSS score	9.8 (critical)
Vulnerability class	Unauthenticated arbitrary file upload
Affected versions	All versions ≤ 1.56.1
Patched version	1.56.2, released July 31, 2026
Total installs	600,000+
Estimated vulnerable	~300,000 sites
Discovered by	Defiant (Wordfence)
Authentication required	None

How does the file upload bypass actually work?

Forminator keeps a blocklist of dangerous file extensions, but it matches keys exactly. Attackers defeat that with pipe-alternative MIME type keys the blocklist does not recognise, combined with a forged Select field value that makes the public submission handler trust an attacker-controlled upload field configuration.

Two design decisions combine badly here. First, a blocklist instead of an allowlist — anything the developers did not think of gets through. Second, the public submission handler trusting field configuration supplied in the request rather than reading it from the saved form definition on the server.

According to SecurityWeek (August 18, 2026), Defiant’s assessment is that this “can lead to complete site compromise through webshells and other techniques.”

Is my site actually exploitable?

Only if you run a vulnerable version and publish a form containing both a File Upload field and a Select field — the attack needs both. On top of that, Forminator’s default upload storage blocks PHP execution, so sites left on defaults are protected from code execution even when the upload succeeds.

That narrows real-world risk considerably, but do not treat it as a reason to delay. Work through this checklist:

Version. Is Forminator at 1.56.1 or below? If yes, you are affected.
Form shape. Does any published form contain both a File Upload field and a Select field?
Storage location. Have you changed the custom upload storage path away from the plugin default?
Execution. Can PHP run in the directory where those uploads land?

Answer yes to all four and you are in the group that faces unauthenticated remote code execution. Answer yes to only the first two and an attacker can still place arbitrary files on your server, which is bad enough on its own.

How do I fix the Forminator vulnerability?

Update Forminator to 1.56.2 or later. That is the complete fix and it has been available since July 31, 2026. If you cannot update immediately, unpublish any form that pairs a File Upload field with a Select field, which removes the precondition the exploit depends on.

# Check the installed version
wp plugin get forminator --field=version

# Update to the patched release
wp plugin update forminator

# Confirm you are on 1.56.2 or later
wp plugin list --name=forminator --fields=name,status,version

After updating, check whether anything was uploaded before you patched. Look in your Forminator uploads directory for files with unexpected extensions, and search the web root for PHP files newer than your last deployment:

# PHP files modified in the last 60 days under wp-content
find wp-content/ -name "*.php" -type f -mtime -60 -ls

If that turns up something you did not put there, treat the site as compromised and follow a full cleanup rather than deleting the single file. Our WordPress webshell cleanup guide covers the full procedure.

Has CVE-2026-15748 been exploited in the wild?

No in-the-wild exploitation had been reported as of August 18, 2026, when the flaw was publicly detailed. That is not a reason to relax. Automated bots routinely begin probing for newly disclosed WordPress plugin flaws within hours of public disclosure, well before most administrators see an alert.

The patch shipped on July 31 and the public write-up landed on August 18. That gap is the useful part: the details attackers need are now public, while a large share of the install base has not updated. Historically that is exactly when mass scanning starts.

If you run a form plugin at all, this is a good moment to review what else is exposed. Our roundup of the best WordPress form plugins compares how the major options handle file uploads, and a WordPress firewall plugin can virtually patch flaws like this while you schedule the real update.

How do I audit my forms for the risky combination?

Open each published form and look for a File Upload field and a Select field in the same form. Only that pairing meets the exploit’s precondition, so a site running ten upload-free contact forms was never exposed. The audit takes a few minutes and tells you whether this was ever urgent for you.

Go to Forminator → Forms and list every form marked published.
Open each and check the field list for a File Upload field.
If one exists, check whether the same form also contains a Select field.
Note where that form stores uploads — default location or a custom path.
Unpublish or remove the Select field on any form matching all three conditions until you have updated.

Draft and unpublished forms do not count, because the exploit needs a reachable public submission endpoint. Embedded forms on password-protected pages are a grey area — treat them as exposed unless you have confirmed the endpoint itself rejects unauthenticated submissions.

Keep a record of what you found. If you later discover unexpected files on the server, knowing which forms were exploitable and when narrows the investigation window considerably.

Frequently asked questions

Which Forminator version fixes CVE-2026-15748?

Version 1.56.2, released on July 31, 2026. Every version up to and including 1.56.1 is vulnerable. Updating is the complete fix; no configuration change is required afterwards.

Do I need to be logged in to exploit this flaw?

No. CVE-2026-15748 is unauthenticated, which is why it carries a CVSS score of 9.8. Any visitor who can reach a qualifying public form can attempt the upload without an account.

Am I safe if I never changed the upload storage settings?

You are protected from code execution, not from the upload itself. Forminator’s default storage configuration prevents PHP from running in the upload location. Sites using a custom file upload storage path lack that protection and face full remote code execution.

How many sites are affected?

Forminator has more than 600,000 active installations, and WordPress.org version data indicated roughly half were still on a vulnerable release when the flaw was disclosed — about 300,000 sites.