Over 300,000 WordPress sites are potentially exposed to hacking due to a critical vulnerability in the Forminator Forms plugin, which allows attackers to upload executable files and execute code remotely. This means that thousands of websites could be compromised, leading to site takeover and data theft.
The issue, tracked as CVE-2026-15748 with a CVSS score of 9.8, lies in the handle_file_upload function of the Forminator Forms plugin. Insufficient file type validation allows unauthenticated attackers to upload executable files, which can then be executed when requested directly. This is particularly concerning because default configurations protect files from PHP execution, but custom settings can leave sites vulnerable.
The vulnerability affects all versions of Forminator Forms up to 1.56.1 and was patched in version 1.56.2, released on July 31. With over 600,000 installations, the plugin is widely used among WordPress site owners. According to WordPress data, half of these installations are running a vulnerable version, meaning that over 300,000 sites could be at risk.
The attack vector involves attackers forging records using the Select field on a form, taking control of the field configuration passed to the upload function, and bypassing the plugin’s blocklist of dangerous file types. This combination of weaknesses allows attackers to inject PHP code into the site, which can then be executed remotely.
While there are currently no reports of in-the-wild exploitation, it is essential for Forminator Forms users to update their plugin to version 1.56.2 as soon as possible. Site owners should also review their custom settings and ensure that files are not stored in a directory that allows PHP execution.
As with all arbitrary file upload vulnerabilities, this issue can lead to complete site compromise through the use of webshells and other techniques. In other words, if an attacker gains access to your site via this vulnerability, they could potentially take control of it entirely, allowing them to steal sensitive data or use it for malicious activities.
To mitigate this risk, WordPress site owners should prioritize updating their plugins regularly, including Forminator Forms. This will ensure that any known vulnerabilities are patched and the site remains secure. Additionally, users should be cautious when installing third-party plugins and review their settings carefully to prevent similar issues in the future.
Source: SecurityWeek — 2026-08-18