A critical security vulnerability in Forminator Forms, a WordPress plugin with more than 600,000 active installations, could allow unauthenticated attackers to upload malicious files and potentially take complete control of vulnerable websites.
Tracked as CVE-2026-15748, the vulnerability has received a CVSS score of 9.8 out of 10, placing it in the critical severity category. The flaw was discovered and reported by a security researcher using the online alias “daroo.”
According to Wordfence, the vulnerability allows attackers who do not need to be logged in to upload arbitrary files, including executable PHP files, to affected WordPress sites. If successfully exploited, the uploaded code can be executed on the server, potentially giving an attacker remote control over the website.
Successful exploitation does require a specific form configuration. The affected site must have a Forminator form containing both a File Upload field and a Select field.
The vulnerability affects Forminator Forms versions 1.56.1 and earlier. It was fixed in version 1.56.2, which was released on July 31, 2026. Website administrators using the plugin are therefore advised to update to the patched version.
The flaw is located in the plugin’s handle_file_upload() function and is caused by insufficient validation of uploaded file types. Wordfence said attackers can bypass the plugin’s dangerous-extension checks by abusing the way MIME type information is processed, while also manipulating upload configuration through a forged Select field value.
An attacker can use the vulnerable public form submission process to upload a specially crafted PHP file without authentication. Once the malicious file can be executed, the attacker could potentially gain control of the WordPress installation and use that access to compromise the entire website.
There is also an important configuration-related factor that can affect exploitation. Forminator normally stores uploaded files in a directory protected by an .htaccess file that prevents PHP files from being executed. However, Wordfence noted that sites using a Custom File Upload Storage root may not receive the same protection.
In that configuration, the required .htaccess file may only be created when the storage directory is first used during a frontend request. Because the WordPress helper responsible for creating the protection file may not be loaded at that point, an uploaded PHP file could potentially be executed simply by requesting it from the server.
The Forminator disclosure comes shortly after Wordfence highlighted another critical vulnerability affecting the User Profile Builder WordPress plugin, which has more than 40,000 active installations.
Tracked as CVE-2026-15826, the authentication bypass vulnerability also carries a CVSS score of 9.8 and could allow unauthenticated attackers to log in as the account with user ID 1, which is typically the WordPress administrator.
The vulnerability was fixed in User Profile Builder version 3.16.5, released on July 16, 2026. Earlier versions are affected, although exploitation requires the plugin’s Automatically Log In feature to be enabled.
The authentication bypass is caused by the plugin’s wppb_log_in_user() function incorrectly processing an error returned by WordPress during user registration. Under specific conditions involving a 61-to-70-character username, WordPress returns a WP_Error object, but the plugin converts that object into the integer 1 before checking whether an error occurred.
This can cause the plugin to generate an autologin token associated with user ID 1, potentially allowing an unauthenticated attacker to access the site’s administrator account and take over the WordPress installation.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
WordPress site owners using either Forminator Forms or User Profile Builder should update to the latest available versions as soon as possible and ensure their plugins remain fully up to date.
