Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks

Cybersecuritynews •Abinaya • August 18, 2026

A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files, potentially enabling them to take full control of vulnerable websites. The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8. Forminator Forms is a widely used […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in WordPress Plugins Allow Unauthenticated File Uploads Recent vulnerabilities in popular WordPress plugins, Forminator Forms (CVE-2026-15748) and Elementor Pro (CVE-2026-32475), allow unauthenticated attackers to upload executable PHP files, leading to potential remote code execution. The Forminator flaw affects versions up to 1.56.1, while Elementor Pro versions prior to 4.2.2 are impacted. Both vulnerabilities exploit logic errors in file upload handling, enabling attackers to bypass security checks. Forminator has over 600,000 active installations, while Elementor Pro is used by more than 6 million sites. Security patches were released on August 19, 2026, and administrators are urged to update immediately to mitigate risks. The vulnerabilities pose a significant threat due to the ease of exploitation and the potential for complete site compromise. 30 sources 72

Extracted Entities

Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)