Critical Vulnerability in Forminator Forms WordPress Plugin Exposes 600,000+ Sites to Remote Takeover A severe security flaw in the Forminator Forms WordPress plugin (CVE-2026-15748, CVSS 9.8) allows unauthenticated attackers to upload malicious PHP files, potentially leading to full website compromise. The vulnerability affects versions 1.56.1 and earlier of the plugin, which is used by over 600,000 active installations for building forms, polls, quizzes, and payment systems. Discovered by security researcher daroo through the Wordfence bug bounty program, the flaw was reported and validated on July 14, 2026. The vendor released a patch in Forminator Forms version 1.56.2 on July 31, 2026. The exploit stems from improper file-upload handling, where attackers can forge upload configurations via the plugin’s Select field. By manipulating values such as the field name, type, and file settings, malicious requests bypass the plugin’s blocklist-based extension filtering. For example, using ph(p) instead of the blocked php extension evades detection, as WordPress still interprets it as a valid PHP file. While uploaded files are typically stored in a directory protected by .htaccess rules, sites with custom upload paths may lack this safeguard. If a PHP file lands in an executable, web-accessible location, attackers can trigger remote code execution (RCE), deploy webshells, steal credentials, or gain full control of the site. Administrators are urged to update to the latest version and audit form configurations, upload directories, and server-side execution permissions.