Half a Million WordPress Sites Running Vulnerable Form Plugin — 300,000 Still Unpatched

A critical flaw in the Forminator Forms WordPress plugin has left roughly 300,000 websites open to remote code execution, according to researchers at WordPress security firm Defiant. The plugin has over 600,000 active installations, and WordPress's own usage data suggests around half are still running a vulnerable version.

The vulnerability, tracked as CVE-2026-15748, scores a 9.8 on the CVSS scale. That's about as bad as it gets before someone just hands attackers the keys directly.

The flaw lives in the plugin's handle_file_upload function, which fails to properly validate uploaded file types. An unauthenticated attacker can exploit this to upload executable files and achieve arbitrary code execution on the server.

The mechanism involves a few weaknesses stacked on top of each other. Attackers can forge values in a Select field on a form, which lets them manipulate the upload field configuration passed to the function. The plugin does maintain a blocklist of dangerous file extensions, but it uses exact-key matching, which can be bypassed by supplying pipe-alternative MIME type keys. The upload handler then trusts the attacker-controlled configuration, and the rest follows naturally.

In default setups, uploaded files land in a directory that blocks PHP execution, which limits the damage. The problem is that if a custom file upload storage root has been configured, that protection doesn't apply. A PHP file dropped there will execute when accessed directly, and at that point you're looking at webshell deployment and full site compromise.

Forminator released a patched version, 1.56.2, on July 31st. The fix covers all versions up to and including 1.56.1. There are no confirmed reports of active exploitation yet, though with 300,000 exposed sites and a public vulnerability disclosure, that window is unlikely to stay open for long.

If you're running Forminator Forms, update now. This isn't one to sit on.