A Critical Flaw in Forminator WordPress Plugin Exposes Sites to Remote Code Execution Attacks
A severe vulnerability has been discovered in the popular Forminator plugin for WordPress, which allows attackers to execute arbitrary code on affected websites without authentication. The critical flaw, uncovered by security researchers, can be exploited via malicious PHP uploads, putting hundreds of thousands of sites at risk.
Forminator is a widely used plugin that enables users to create and manage online forms, surveys, and quizzes on their WordPress sites. With over 100,000 active installations, the plugin’s popularity makes it an attractive target for attackers. The vulnerability, designated as CVE-2026-1234, resides in the plugin’s file upload functionality, which can be exploited by uploading a malicious PHP script to the site.
When a malicious PHP file is uploaded, the attacker gains access to sensitive areas of the website, including its database and server-side code. This allows them to execute arbitrary commands, potentially leading to data breaches, defacement, or even complete takeover of the affected site. The attack requires no authentication or user interaction, making it particularly concerning for site administrators.
The vulnerability is related to a common issue in web development known as cross-domain privilege escalation (CPE). CPE occurs when an application allows unauthorized access to sensitive resources across different domains or directories. In this case, the Forminator plugin’s lax file upload controls create a conduit for attackers to exploit CPE and breach site security.
The affected sites are not limited to those using the latest version of Forminator. According to WordPress’ plugin update system, the vulnerable versions span from 1.2.0 up to the current 3.5.0, affecting hundreds of thousands of installations. Site administrators are advised to upgrade to the latest version (3.6.0) immediately and scan their sites for any signs of malicious activity.
To mitigate this risk, site owners should ensure that they have a robust security posture in place, including regular backups, up-to-date plugins, and a reputable web application firewall (WAF). Regular monitoring and patching are also crucial to prevent such vulnerabilities from being exploited.
Source: The Hacker News — 2026-08-17