Critical Forminator WordPress Flaw Allows Unauthenticated RCE via Malicious PHP Uploads

A critical vulnerability has been disclosed in the Forminator Forms WordPress plugin, which has over 600,000 active installations. Tracked as CVE-2026-15748 and rated 9.8 on the CVSS scale, the flaw could allow unauthenticated attackers to upload arbitrary files, including executable PHP files, leading to remote code execution and complete site compromise.

According to Wordfence, the vulnerability resides in the handle_file_upload() function due to insufficient file type validation. The dangerous-extension blocklist performs exact-key matching that can be bypassed by pipe-alternative MIME type keys. Additionally, a public submission handler trusts attacker-controlled upload field configuration injected via a forged Select field value. Successful exploitation requires a form containing both a File Upload field and a Select field.

In default configurations, uploaded files are stored in a directory protected by an .htaccess file that prevents PHP execution. However, if a site administrator has configured a Custom File Upload Storage root, the .htaccess protection may not be applied because the file is created only when first needed during a frontend request where the WordPress helper responsible for writing the .htaccess file is not loaded. This allows an attacker to simply request the uploaded file to trigger execution of the malicious PHP code.

The vulnerability affects all versions of Forminator before and including 1.56.1. It has been patched in version 1.56.2, released on July 31, 2026. Site owners are strongly advised to update to the latest version immediately.

In a related disclosure, Wordfence also highlighted a critical authentication bypass flaw in the User Profile Builder plugin, tracked as CVE-2026-15826 (CVSS score: 9.8). This vulnerability, patched in version 3.16.5 on July 16, 2026, could allow unauthenticated attackers to log in as the site administrator (user ID 1) when the plugin’s Automatically Log In setting is enabled. The issue arises from the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check, which can coerce a WP_Error object to the integer 1 and bind a transient-backed autologin nonce to user ID 1.

Administrators using either plugin should apply the available updates as soon as possible to mitigate these serious security risks.