A critical remote code execution vulnerability (CVE-2026-15748, CVSS 9.8) has been discovered in the Forminator Forms WordPress plugin, affecting all versions up to 1.56.1. The flaw allows unauthenticated attackers to bypass file type validation and upload executable files, potentially leading to full site compromise — but only poses a significant risk when a Custom File Upload Storage root has been configured. The bug was patched in version 1.56.2 on July 31, though roughly 300,000 of the plugin's 600,000+ installations are still running a vulnerable version.
