Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Back Thehackernews

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Thehackernews •[email protected] (The Hacker News) • August 17, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple WordPress Plugins Vulnerable to Unauthenticated RCE via PHP Uploads Two vulnerabilities have been identified in popular WordPress plugins, Elementor Pro and Forminator, allowing unauthenticated attackers to upload malicious PHP files and execute code. The Elementor Pro flaw, reported on August 20, 2026, poses a significant risk as it enables remote code execution (RCE) without authentication. Similarly, the Forminator vulnerability, disclosed on August 17, 2026, allows for the same type of attack. Both plugins are widely used, increasing the potential impact on numerous WordPress sites. The vulnerabilities have not been assigned CVEs yet, but they are critical for site administrators to address. Users are urged to monitor their installations and apply patches as soon as they become available. The situation is evolving, and security teams should prioritize these vulnerabilities to mitigate risks. 2 sources 68

Extracted Entities

Attack Types (1)

Zero-day Exploit

CWE Weaknesses (1)

Cwe-434 - Unrestricted Upload Of File With Dangerous Type

Platforms (1)