WPMU DEV shipped Forminator Forms 1.56.2 on July 31, patching an unauthenticated arbitrary file upload bug now tracked as CVE-2026-15748. The flaw was published to the National Vulnerability Database on August 18, carries a CVSS score of 9.8 (Critical), and affects every version of the plugin up to and including 1.56.1. Forminator runs on more than 600,000 active WordPress sites, and any site with a form combining a File Upload field and a Select field is exposed, no login required.
What the Forminator vulnerability actually does
The bug sits in the plugin’s handle_file_upload() function, which is supposed to block dangerous file types before accepting an upload. According to reporting from The Hacker News, the blocklist checks file extensions using exact-key matching, and that check can be bypassed by submitting a MIME type key with a pipe character as an alternative. On top of that, the public form submission handler trusts upload field configuration that comes from the request itself, meaning an attacker can forge the Select field value to redefine what the upload field will accept. Put together, those two gaps let someone with no account on the site upload a working PHP file and get it executed.
The catch that matters for triage: exploitation needs a form that already has both a File Upload field and a Select field configured. Plenty of Forminator forms only use one or the other, which narrows who’s actually exposed, but forms built for job applications, document submissions, or anything pairing a file with a dropdown (a document type, a category, a department) hit that combination often. Default Forminator installs write uploads into a directory protected by an .htaccess file that blocks direct PHP execution, but sites using a custom upload storage path may not have that protection in place, which is where this turns into full remote code execution rather than just a stray file sitting on the server. The bug was reported by a researcher going by the handle “daroo.”
What to do about it
Update Forminator to 1.56.2 or later now if you haven’t already. It’s been available since July 31, so on a lot of sites this may already be handled by auto-updates, but it’s worth confirming rather than assuming, especially on client sites where plugin updates get held back for testing.
If a site has any form mixing a file upload with a select or dropdown field, that’s the configuration to check first. Look at where uploaded files actually land on disk and confirm that directory can’t execute PHP, since that’s the difference between “someone uploaded junk” and “someone got a shell.” This kind of form-by-form review is part of what we look at during a plugin development engagement, and it’s the same category of bug we flagged in this week’s User Profile Builder vulnerability: an unauthenticated path to full site compromise on a plugin most agencies treat as low-risk because it’s “just a form builder.”
