Unauthenticated RCE Vulnerability Patched in Forminator Forms Plugin

WPMU DEV released a security update for Forminator Forms to fix a critical vulnerability that allows unauthenticated attackers to upload malicious files. Attackers can use this bug to run code on the server and take full control of the website.

The flaw is tracked as CVE-2026-15748 (CVSS score 9.8) - an unauthenticated arbitrary file upload vulnerability exists in the handle_file_upload function. Attackers bypass file type checks by using a forged Select field to inject malicious configurations and using regex-compatible MIME keys like ph(p) . The flaw allows remote code execution and full site compromise.

The attack works by chaining two separate logic errors in the plugin code. First, the set_field_data function allows an attacker to use a Select field to inject a forged Upload record into the internal data array. Second, the forminator_allowed_mime_types function uses a weak blocklist that only checks for exact matches of dangerous extensions. An attacker can bypass the php filter by providing a pattern like ph(p)|text/x-php . WordPress still recognizes this as a PHP file but the plugin blocklist does not catch it.

Successful exploitation allows unauthenticated users to upload PHP files and run them on the server up to complete site compromise. Attackers can use webshells to browse files, steal database credentials, or move to other systems on the network. The risk is higher for sites using custom storage roots because these folders often lack the .htaccess files that stop PHP execution.

Administrators should update Forminator Forms to version 1.56.2 or later immediately to fix the flaw. Administrators should also check your server for any unauthorized PHP files in the upload directories. If you cannot update the plugin, remove any forms that use both File Upload and Select fields to reduce the risk.