Forminator Forms Vulnerability: 7 Essential Fixes (2026)

The Forminator Forms vulnerability, tracked as CVE-2026-15748, is a critical flaw that lets unauthenticated attackers upload malicious PHP files to any of the 600,000+ WordPress sites running the plugin. It carries a CVSS score of 9.8 out of 10. If you run Forminator Forms version 1.56.1 or earlier, your site can be taken over completely — here’s exactly how to check if you’re exposed and fix it today.

What Is the Forminator Forms Vulnerability (CVE-2026-15748)?

CVE-2026-15748 is an unauthenticated arbitrary file upload vulnerability in Forminator Forms, the WPMU DEV-built contact, quiz, poll, and payment form builder for WordPress. It affects every plugin version up to and including 1.56.1, across both the free and Forminator Pro editions.

The bug lives in the plugin’s file upload field handler, the code path that runs whenever a public visitor submits a form containing a file field. A specially forged form submission can bypass the dangerous-file-extension blocklist and drop an executable PHP file directly onto the server, according to the vulnerability writeup on Rapid7’s vulnerability database (Rapid7, 2026).

Once a PHP file lands in an accessible directory, an attacker can run it directly by visiting its URL in a browser. That means full remote code execution without ever logging in, creating an account, or tricking an administrator into clicking anything.

Because Forminator ships with more than 600,000 active installations, this single flaw put a large slice of the WordPress ecosystem at risk the moment researchers made the technical details public.

How Does CVE-2026-15748 Actually Work?

The root cause is a blocklist bypass combined with a trust failure, and both halves matter for understanding why the fix required more than a one-line patch.

Forminator’s public submission handler blocks obviously dangerous extensions like .php, .phtml, and .phar, but it checks them using exact-key matching against a table of MIME type mappings. That approach only works if every possible way of describing a MIME type is anticipated in advance.

Attackers exploit the gap by submitting pipe-separated, alternative MIME type keys that never match the blocklist’s exact strings, even though the underlying file extension is still dangerous. The upload sails through validation because the check is comparing strings, not actually verifying safety.

The second half of the bug is more serious: the public-facing form handler trusts upload field configuration that arrives inside the submitted data itself, delivered via a forged Select field value. That means an attacker doesn’t even need an existing file-upload field on the target form. They can inject a fake one into a plain contact form at submission time and have the plugin honor it.

Combined, these two flaws let anyone who can reach a public Forminator form upload a file and then execute it as code, with no account, no admin session, and no user interaction from a site owner required.

What CWE Category Does This Vulnerability Fall Under?

CVE-2026-15748 is classified under CWE-434, “Unrestricted Upload of File with Dangerous Type.” This is one of the most consistently dangerous weakness categories tracked in the MITRE CWE list, because it converts a simple form submission into direct code execution on the server rather than requiring a multi-step exploit chain.

Knowing the CWE category is useful beyond this one plugin. If you manage several sites, searching your other installed plugins’ changelogs for “CWE-434” or “arbitrary file upload” fixes is a fast way to spot whether you’ve been exposed to a similar issue elsewhere without waiting for a roundup article to tell you.

Is Your Site Affected by the Forminator Forms Vulnerability?

You’re at risk if Forminator Forms is active on your site and its version is 1.56.1 or older. There are two quick ways to check.

1. In wp-admin, go to Plugins and read the version number listed directly under the Forminator Forms entry.
2. Via WP-CLI, run wp plugin get forminator --field=version from your site’s root directory over SSH.

Any version at or below 1.56.1 is vulnerable, regardless of how long ago it was installed. Version 1.56.2, released July 31, 2026, contains the complete fix, according to The Hacker News’ coverage of the disclosure (The Hacker News, 2026).

It doesn’t matter whether you’re running the free Forminator Forms plugin or the paid Forminator Pro add-on — the vulnerable upload-handling code is shared across both, since Pro builds on top of the free plugin’s core rather than replacing it.

Multisite networks deserve extra attention here. A single vulnerable Forminator install shared across a network can expose every site on that network, not just the one where the form lives.

How Do You Fix the Forminator Forms Vulnerability? (7 Steps)

Fixing this is mostly about updating fast, then verifying nobody got there first. Work through these seven steps in order, and don’t skip the verification steps even if your update went smoothly.

1. Update Forminator immediately. In wp-admin, go to Plugins, locate Forminator Forms, and click Update Now, or run wp plugin update forminator via WP-CLI. This alone closes the hole for any new attack attempts, but it does nothing about files already uploaded before you patched.
2. Check your uploads directory for unfamiliar PHP files. Look inside wp-content/uploads/forminator/ and any custom upload paths you’ve configured. Any .php or oddly named file that isn’t an image, PDF, or document you recognize submitting is suspect and should be quarantined, not deleted, until reviewed.
3. Scan the full site with a malware scanner. Wordfence, Sucuri SiteCheck, or a WP-CLI-based scanner can catch webshells that have already spread beyond the uploads folder into theme or plugin directories, which a manual folder check alone will miss.
4. Review the WordPress users list for unfamiliar administrators. A successful exploit often ends with the attacker creating a new admin account for persistent access, since a webshell can be found and deleted but a rogue admin account blends in with legitimate users.
5. Rotate every credential tied to the site. This means WordPress admin passwords, database passwords, hosting control panel logins, and any API keys or SMTP credentials stored in plugin settings that an attacker with code execution could have read.
6. Check your server’s access and error logs around suspicious dates. Look for POST requests to your Forminator form endpoints with unusual payloads, base64-looking strings, or file extensions appearing in the request body rather than the expected form fields.
7. Turn on a web application firewall rule for file upload endpoints. A WAF like Wordfence’s virtual patching feature can block malicious upload attempts even before every site in a multi-site or agency environment has been manually updated.

What Are the Key Dates in the Forminator Forms Vulnerability Timeline?

• July 14, 2026 — Wordfence’s threat intelligence team validates the report and privately discloses it to the Forminator development team.
• July 31, 2026 — WPMU DEV ships Forminator Forms version 1.56.2, containing the complete fix for CVE-2026-15748.
• August 2026 — Full technical details of the vulnerability become public, and security outlets including The Hacker News report that hundreds of thousands of sites remain on vulnerable versions.
• Ongoing — Site owners who haven’t updated past 1.56.1 remain exposed until they apply the patch described in this guide.

How Long Did It Take From Disclosure to Patch?

The response timeline on this one was fast by industry standards. Wordfence validated the initial report and disclosed it to the Forminator development team on July 14, 2026, and a complete fix shipped just seventeen days later, on July 31, 2026.

That turnaround matters because the gap between disclosure and patch is exactly the window attackers race to exploit before site owners update. A seventeen-day response is on the quicker end for a plugin of Forminator’s size, but security researchers still estimated that hundreds of thousands of sites remained on vulnerable versions once the technical write-up became public in August, simply because most site owners don’t update the moment a patch is available.

That gap between “a fix exists” and “most sites have applied it” is the real lesson here. It’s also why updating immediately, rather than waiting for a scheduled maintenance window, is the single highest-leverage action from the fix steps above.

How Does Forminator Compare to Other 2026 WordPress Plugin Vulnerabilities?

CVE-2026-15748 is serious, but it wasn’t the only critical form-and-payment plugin flaw disclosed in 2026. Comparing it against other recent incidents, reported by outlets including cybersecuritynews.com (2026), shows that unauthenticated file upload bugs have become one of the most common critical-severity issues in the WordPress plugin ecosystem this year.

The pattern across all four is the same: a public-facing input — a form field, an upload handler, a donation form — trusted more than it should have. That’s the vulnerability class to watch for across any plugin accepting visitor input, not just form builders.

What Should You Do If You Were Already Compromised?

If step 2 or step 3 above turned up a webshell or an unfamiliar file, treat the entire site as compromised, not just the one file you found. Attackers who successfully exploit an unauthenticated upload flaw routinely drop more than one backdoor, precisely so that removing the first one doesn’t lock them out.

Take the site offline or switch it into maintenance mode first, so you’re not leaving an active backdoor reachable while you investigate. Then restore from a clean backup taken before the earliest suspicious log entry you found — patching the plugin alone does not remove a webshell that has already been planted on disk.

If you don’t have a clean backup, or you’re unsure how deep the compromise goes, bring in a WordPress security specialist rather than guessing. Removing a webshell by hand is easy to get wrong, particularly when an attacker has also modified core or theme files to survive a plugin-only cleanup.

After cleanup, change every credential again, not just the ones you rotated earlier, and keep a malware scanner running on a schedule for at least a few weeks to catch anything dormant that resurfaces later.

How Can You Prevent Future WordPress Plugin Vulnerabilities Like This?

Turn on automatic updates for plugins where you trust the vendor’s release quality, so patches like 1.56.2 apply within hours instead of the weeks it can take a busy site owner to notice a manual update is available. For sites where you review every update by hand, subscribe to a vulnerability feed so you hear about critical CVEs the same day they’re disclosed, not weeks later in a roundup post.

Limit the number of form-building and file-upload-handling plugins you run on any one site. Every plugin that accepts a file from an anonymous visitor is a potential attack surface, and consolidating onto fewer, actively maintained tools reduces how many of those surfaces you’re exposed to at once.

If your site is already following the fixes covered in our guide to the WordPress 7.0.4 security update, extend that same discipline to third-party plugins, not just WordPress core itself — core updates alone would not have stopped this exploit.

It’s also worth reading the Elementor Pro vulnerability and WPForms Lite backdoor writeups on this site. Both share the same root pattern of an unauthenticated file upload leading to full site takeover, and the same fix habits from this guide apply directly to them. The WordPress XSS2Shell vulnerability writeup covers a related but distinct attack chain worth understanding too, since defending against one doesn’t automatically defend against the other.

Should Hosting Providers Share the Responsibility Here?

Managed WordPress hosts increasingly run their own malware scanning and virtual patching layers on top of what individual plugins ship, and this incident is a good example of why that extra layer earns its cost. A host that disables PHP execution inside uploads directories by default — a common hardening step — would have blocked this exploit’s second stage even before Forminator’s official patch existed, because the uploaded file simply couldn’t run as code.

If your current host doesn’t offer that kind of upload-directory hardening, it’s worth asking whether they plan to add it, or whether a .htaccess rule denying PHP execution inside wp-content/uploads/ is something you can add yourself. That single server-level rule would have neutralized this entire vulnerability class regardless of which form plugin triggered it.

Is Forminator Alone, or Is This a Wider Form-Plugin Problem?

Unauthenticated file upload bugs have shown up in more than one popular WordPress form plugin in 2026, not just Forminator. That’s not a coincidence — form builders are, by design, one of the few plugin categories built specifically to accept files from logged-out visitors, which makes the upload handler the single most security-critical piece of code in the entire plugin.

If you run any form plugin — not just Forminator — it’s worth treating file upload fields as a feature to enable deliberately rather than by default. Turn off file uploads on public forms that don’t strictly need them, and for the ones that do, keep the plugin’s auto-update setting on so a fix like 1.56.2 reaches your site the same day it ships.

Frequently Asked Questions

Is Forminator Forms still safe to use after this vulnerability?

Yes, once you’re running version 1.56.2 or later. The vendor’s fix directly closes both the blocklist bypass and the forged field-configuration trust issue that made CVE-2026-15748 exploitable, and no further public reports of the same code path have surfaced since the patch shipped.

How do I know if my site was already exploited?

Check for unfamiliar PHP files in your uploads folder, unrecognized WordPress admin accounts, and unusual outbound traffic or CPU spikes from your server. A full malware scan is the fastest way to confirm either way, and it’s worth running even if nothing looks obviously wrong.

Does this vulnerability affect Forminator Forms Free or only Forminator Pro?

Both. The vulnerable upload-handling code is shared between the free and Pro versions, so every site running an affected version needs the same 1.56.2 update regardless of which license tier it’s on.

What is the CVSS score for CVE-2026-15748 and what does it mean?

The vulnerability carries a CVSS score of 9.8 out of 10, which puts it in the critical severity band. That score reflects that exploitation needs no authentication, no user interaction from a victim, and can lead to complete server compromise in a single request.

Can a web application firewall protect me before I update?

A WAF rule targeting file upload endpoints can block many exploit attempts in the meantime, but it’s a stopgap, not a substitute for the fix. Update to 1.56.2 as soon as possible rather than relying on a firewall alone, since new bypass techniques surface regularly.

Where can I read the official technical details of this vulnerability?

The clearest technical breakdown is in The Hacker News’ report on the disclosure, and the formal vulnerability record, including its CVSS scoring and affected version range, is maintained in Rapid7’s vulnerability database — both linked earlier in this guide.

Forminator’s fix in version 1.56.2 closes a genuinely dangerous hole, but the update only protects your site going forward. Run through the seven steps above today, especially the uploads-folder and admin-account checks, and you’ll know within minutes whether this is a routine patch or an active incident on your site.