A critical arbitrary file upload vulnerability, tracked as CVE-2026-15748 with a CVSS score of high, affects Forminator Forms versions 1.56.1 and earlier. The vulnerability is particularly serious because it can be exploited without authentication, potentially allowing attackers to upload malicious PHP files and achieve remote code execution. Forminator Forms is a widely deployed WordPress plugin used to create contact, payment, poll, quiz, and file-upload forms, with more than 600,000 active installations, making the issue a significant threat to a large number of WordPress websites.

The vulnerability was discovered by security researcher. Wordfence validated the vulnerability on July 14, 2026, and reported it to the Forminator development team the same day. The vendor subsequently released Forminator Forms version 1.56.2 on July 31, 2026. The underlying weakness exists in the plugin's file-upload processing, where attackers can inject a forged upload configuration through the Select field of a published form. Forminator may then process attacker-controlled values, including the upload field name, field type, and file-handling settings, as if they were legitimate configuration data.

A major factor enabling exploitation is a weakness in Forminator's file-extension filtering mechanism. Although the plugin attempts to block dangerous extensions such as PHP through a blocklist, the filtering relies on exact matching against extension keys. Attackers can bypass this protection by using the pattern ph(p) instead of php, which WordPress can still interpret as matching a .php extension. When combined with an appropriate MIME type such as text/x-php, this technique can allow a malicious PHP payload to pass the plugin's validation and be uploaded. Normally, Forminator stores uploaded files in a directory protected by an .htaccess rule that prevents PHP execution; however, custom upload storage locations may lack this protection under certain configurations.

If the malicious file is uploaded to an executable and web-accessible directory, an attacker could directly access the PHP file and execute arbitrary commands on the underlying server. Successful exploitation could therefore result in webshell deployment, theft of WordPress credentials, unauthorized database access, malware installation, remote code execution, and potentially complete website or server compromise. Administrators should immediately upgrade Forminator Forms to version 1.56.2 or later, review existing form and upload configurations, inspect upload directories for suspicious PHP or executable files, and ensure that uploaded files cannot be executed as server-side code. Organizations should also review custom upload locations and apply appropriate server-side restrictions to prevent PHP execution from user-uploaded directories.