Published Wednesday, August 19, 2026 at 10:38 AM PT

CVE-2026-15748: Forminator WordPress Plugin Unauthenticated RCE—Arbitrary File Upload Flaw

BLUF: Critical vulnerability in Forminator WordPress plugin (CVSS 9.8) allows unauthenticated attackers to upload and execute arbitrary PHP files, resulting in complete website takeover. Patch status unknown. Immediate defensive action required for all WordPress installations running Forminator.

DETAILS

  • Vulnerability: Arbitrary file upload flaw in Forminator Forms plugin for WordPress. Requires no authentication to exploit.
  • CVSS Score: 9.8 (Critical). Combines high confidentiality, integrity, and availability impact with network-accessible attack vector.
  • Attack Surface: Authenticated requirement not present—any unauthenticated user can trigger exploitation, including automated scanners.
  • Payload: Uploaded executable PHP files can be executed server-side, granting attackers command execution under the web server process context.
  • Affected Product: Forminator plugin for WordPress. Specific affected versions not confirmed in available intel; version cap unknown.

IMPACT

  • Scope: All WordPress sites with Forminator plugin installed and active are potentially vulnerable.
  • Blast Radius: Compromise enables full website defacement, data exfiltration, malware distribution, lateral movement to backend systems, and credential harvesting.
  • Exploitation Likelihood: High. CVSS 9.8 + unauthenticated attack vector + file upload mechanics make this trivially automatable; exploitation likely already in the wild or imminent.

Immediate (next 4 hours):

  1. Identify all WordPress instances running Forminator plugin: wp plugin list | grep -i forminator.
  2. Do not wait for patches. Temporarily disable Forminator plugin on all affected sites (wp plugin deactivate forminator or via admin panel).
  3. Review web server access logs (past 7 days) for suspicious file uploads to /wp-content/uploads/ or form submission directories; watch for .php files and POST requests to form handlers.
  4. If compromise suspected, isolate affected server immediately and engage forensics.

Short term (24 hours):

  • Monitor Forminator plugin security advisory channels and WordPress.org plugin page for patch notification.
  • When patch is released, test in non-production, then roll out systematically.
  • Scan for web shells: find /var/www -name "*.php" -mtime -7 (last 7 days modified).

Ongoing:

  • Implement file upload restrictions (WordPress security hardening): disable PHP execution in upload directories via .htaccess or Nginx config.
  • Deploy WAF rules to block suspicious file uploads if possible.

SOURCES

  • SOC Prime: CVE-2026-15748 alert (source, specific version impact not fully provided in alert).

Note: Affected version range not yet confirmed in available intel. Assume all recent versions vulnerable until patch guidance is published.

Recent high-severity events at publish time:

Recent high-severity events