Unauthenticated Forminator flaw lets attackers upload PHP and take over WordPress sites

A critical flaw in Forminator Forms, a WordPress plugin with more than 600,000 installations, lets unauthenticated attackers upload executable PHP files and take over a site. Tracked as CVE-2026-15748 and scored 9.8, the bug chains weaknesses in the plugin's upload handling: an attacker smuggles a forged record through a Select field that declares itself a file upload, then slips a PHP file past a blocklist that only checks exact extensions. Exploitation requires a form with both a file upload field and a select field, and it affects all versions up to 1.56.1. Because it needs no authentication, automated scanners can hunt for vulnerable sites at scale.

Check

Update the Forminator plugin to a version newer than 1.56.1 across all WordPress sites, and check for unexpected PHP files in upload directories and unfamiliar administrator activity.

Affected

WordPress sites running Forminator 1.56.1 or earlier with a form containing both a file upload and a select field (CVE-2026-15748); an unauthenticated attacker can upload PHP and fully compromise the site.

Fix

Patch the plugin, put a web application firewall in front of the site, scan for web shells and unauthorized files, and remove or reconfigure vulnerable forms until the update is applied.