OVER 600,000 WordPress sites are at risk due to a critical flaw in the Forminator Forms plugin that allows unauthenticated remote code execution via arbitrary file upload, tracked as CVE-2026-15748 with a CVSS score of 9.8 (Wordfence reported).
The vulnerability resides in the plugin's upload handling where forms containing both a file upload field and a select field can be abused to upload a PHP shell, enabling execution without authentication (according to security researchers). Affected versions are all releases up to and including 1.56.1; the issue is patched in version 1.56.2.
Exploitation does not require any user privileges; an attacker can craft a request that bypasses validation and writes the malicious file to the web root, leading to full server compromise (as outlined by The Hacker News). The CVSS vector reflects high impact on confidentiality, integrity and availability.
Wordfence observed active scanning attempts targeting the flaw shortly after disclosure, though no specific threat actor has been attributed yet (per its blog). The sheer number of installations makes it an attractive target for opportunistic malware campaigns aiming to implant backdoors or cryptominers.
Site administrators should immediately update Forminator to version 1.56.2 or later, which restricts file upload extensions and validates input more strictly (as advised). They should also review upload directories for any unfamiliar PHP files and consider disabling the plugin temporarily if patching is delayed.
Implementing web application firewall rules that block requests with suspicious file extensions or unusual payloads can provide interim protection (per The Hacker News). Regularly monitoring file integrity and access logs helps detect any successful upload attempts before they are abused.