A critical flaw in Forminator Forms, a WordPress plugin with more than 600,000 installations, lets unauthenticated attackers upload executable PHP files and take over a site. Tracked as CVE-2026-15748 and scored 9.8, the bug chains weaknesses in the plugin's upload handling: an attacker smuggles a forged record through a Select field that declares itself a file upload, then slips a PHP file past a blocklist that only checks exact extensions. Exploitation requires a form with both a file upload field and a select field, and it affects all versions up to 1.56.1. Because it needs no authentication, automated scanners can hunt for vulnerable sites at scale.
WordPress patched a pre-authentication reflected cross-site scripting flaw in the login screen that researchers showed can chain into PHP code execution and full server takeover, naming the chain XSS2Shell. Tracked as CVE-2026-64638 and scored 8.9, the cross-site scripting bug affects all WordPress versions and needs no login to trigger. On its own it runs script in a visitor's browser, but when a logged-in administrator is lured to an attacker-controlled page, the chain can reach code execution on the server. Because WordPress runs a large share of the web, a flaw affecting every version and needing no authentication has broad reach.
TrustStrike Labs