Forminator is a popular WordPress plugin with over 600,000 active installations, used for creating forms, quizzes, and polls. A critical arbitrary file upload vulnerability (CVE-2026-15748) was discovered, allowing unauthenticated RCE. The issue was fixed in version 1.56.2.