Forminator Forms: Unauthenticated File Upload RCE (CVE-2026-15748)

Introduction

Forminator Forms, installed on more than 600,000 WordPress sites, had a critical arbitrary file upload vulnerability disclosed and rated CVSS 9.8, tracked as CVE-2026-15748. The flaw is in the plugin’s handle_file_upload() function, where insufficient file type validation lets an unauthenticated attacker upload arbitrary files — including executable PHP files — directly to your server. That’s a straight path to full remote code execution and complete site compromise.

The vulnerability was fixed in version 1.56.2, released July 31, 2026.

What You Should Do Right Now

1. Check if Forminator Forms is installed under Plugins in wp-admin, and confirm the version.
2. Back up your site immediately before updating.
3. Update to 1.56.2 or later as soon as possible.
4. Scan your uploads directory for unfamiliar PHP files, especially inside form-upload folders. A file with a random-looking name and a `.php` extension where only images or documents should be is a red flag.

Why File Upload Bugs Are Worst-Case

Unlike bugs that expose data or crash a page, an unauthenticated file upload flaw that accepts PHP files gives an attacker the ability to run arbitrary code on your server — effectively full control. And because Forminator is used to power public-facing forms (contact forms, applications, quote requests), the vulnerable upload path is often reachable by anyone who finds the form on your site, no login needed.

FAQ

How do I know if my site was already exploited?
Check your uploads folder (especially subfolders tied to form submissions) for any file with a `.php` extension that you didn’t put there, and review your site for unfamiliar admin users or unexpected file changes.

Do I need to remove old form submissions with file uploads?
It’s worth reviewing recent file-upload submissions for anything suspicious, but the priority is updating the plugin and checking for planted files first.

Is the free or pro version affected?
Check your installed version against 1.56.2 regardless of edition — the vulnerable code was in the core file handling logic.

Conclusion

A 9.8-severity, unauthenticated RCE on a plugin with 600,000+ installs is an emergency-update situation. Back up, update to 1.56.2+, and check your uploads folder for anything that shouldn’t be there.