Over 300,000 WordPress Sites Left Exposed to Hacking Due to Critical Plugin Flaw
A critical vulnerability in the Forminator Forms plugin for WordPress has potentially exposed thousands of websites to remote code execution (RCE), according to security firm Defiant. The bug, tracked as CVE-2026-15748 with a CVSS score of 9.8, allows unauthenticated attackers to upload executable files and execute malicious code.
The vulnerability affects all versions of the Forminator Forms plugin up to 1.56.1 and was patched in version 1.56.2, released on July 31. With over 600,000 installations, half of which run a vulnerable version, it’s estimated that more than 300,000 websites are potentially exposed to attacks.
The issue arises from insufficient file type validation in the handle_file_upload function of the plugin. Attackers can bypass the plugin’s blocklist of dangerous file types by using pipe-alternative MIME type keys, and then upload executable files. In default configurations, these files would land in a protected directory that prevents PHP execution. However, if a Custom File Upload Storage root has been configured, the protection is not applied to it, allowing attackers to execute their uploaded code when the file is requested directly.
As Defiant notes, “This can lead to complete site compromise through the use of webshells and other techniques.” The vulnerability is particularly concerning because it’s a combination of several weaknesses that enable attackers to forge records using the Select field on a form, take control of the field configuration passed to the upload function, and bypass the plugin’s blocklist.
Currently, there are no reports of in-the-wild exploitation of this bug. However, users are advised to update their Forminator Forms plugin to version 1.56.2 or later as soon as possible to prevent potential attacks. It’s also essential for website administrators to review their configuration and ensure that Custom File Upload Storage is not enabled.
In the age of digital transformation, it’s more crucial than ever for websites to maintain robust security measures. This vulnerability serves as a reminder that even popular plugins can have critical flaws that need attention. By staying informed about the latest security threats and updates, website owners can protect their online presence from potential attacks and ensure the integrity of their visitors’ data.
Takeaway: If you use Forminator Forms plugin on your WordPress site, update it to version 1.56.2 or later immediately to prevent potential hacking attempts. Review your configuration settings and disable Custom File Upload Storage if not in use.
Source: SecurityWeek — 2026-08-18