Critical Security Flaw in Forminator WordPress Plugin
Vulnerability affecting over 600,000 installations allows remote code execution.
1Critical Vulnerability in Forminator Plugin
A critical security vulnerability has been discovered in Forminator Forms, a WordPress plugin with over 600,000 active installations. This flaw allows attackers to upload arbitrary files, including PHP files, and execute remote code. Tracked as CVE-2026-15748, the vulnerability has a CVSS score of 9.8. Discovered by security researcher 'daroo,' the flaw specifically targets forms containing both File Upload and Select fields.
2Technical Details of the Vulnerability
The vulnerability stems from insufficient file type validation in the handle_file_upload() function. Attackers can upload specially crafted PHP files to execute remote code, potentially leading to complete site compromise. According to Wordfence, the flaw can be bypassed using pipe-alternative MIME type keys, allowing attackers to circumvent file type validation. This makes it possible for unauthenticated attackers to exploit the vulnerability.
3Affected Versions and Fix
The vulnerability affects all versions of Forminator Forms up to and including 1.56.1. It was patched in version 1.56.2, released on July 31, 2026. Site owners are advised to update their plugins to avoid exploitation. By default, files are uploaded to a directory protected by an .htaccess file that prevents PHP execution. However, if a custom file upload directory is used, this protection may not be in place.
4Similar Vulnerability in User Profile Builder
Just days before the Forminator flaw was disclosed, Wordfence identified a critical authentication bypass vulnerability in the User Profile Builder plugin. This flaw allows attackers to log in as the site administrator and take over the site. Tracked as CVE-2026-15826, the vulnerability was patched in version 3.16.5, released on July 16, 2026. The flaw is only exploitable on sites where the plugin's Automatically Log In setting is enabled.
5Potential Impact of the Vulnerability
Such security vulnerabilities can lead to complete site takeover. Attackers can alter site content, steal user data, or use the site to distribute malware. Additionally, these flaws can damage site owners' reputations and cause financial losses. Therefore, timely application of security updates is crucial. Site administrators must remain vigilant and ensure their installations are up-to-date.
6Recommendations for Site Owners
Site owners are advised to update their Forminator Forms and User Profile Builder plugins to the latest versions to avoid exploitation. Additionally, ensuring the security of file upload directories by properly configuring .htaccess files is essential. Security experts recommend regular security audits and prompt patching of vulnerabilities to maintain site integrity.
7The Role of AI in Security
Artificial intelligence can quickly detect vulnerabilities and chain attacks, necessitating faster response times from security teams. While AI accelerates coding processes, it is crucial to ensure that security measures keep pace. Security teams must effectively leverage AI technologies to stay ahead of potential threats and maintain robust defenses.
8Conclusion and Importance
The critical security vulnerabilities in Forminator Forms and User Profile Builder pose significant threats to WordPress site security. Site owners must promptly apply security updates and continuously review their security measures. Such vulnerabilities can lead to both financial and reputational losses for site owners. Prioritizing security measures is essential to safeguarding online assets.
Original article: The Hacker News — Forminator WordPress Eklentisinde Kritik Güvenlik Açığı