CVE-2026-15748: the Forminator plugin accepts PHP uploads without authentication
Published
Forminator Forms has more than 600,000 active WordPress installs. CVE-2026-15748, rated 9.8 out of 10, lets an unauthenticated attacker upload a PHP file and reach code execution. At public disclosure, SecurityWeek estimated that more than 300,000 sites were still running a vulnerable release.
Fixed by the vendor: Forminator Forms 1.56.2 (31 July 2026)
What does this flaw actually do?
The plugin’s `handle_file_upload()` function does not sufficiently validate the file type supplied by the visitor. An attacker forges the form’s upload field configuration and drops a PHP file where the site only expected an attachment.
Every version up to and including 1.56.1 is affected. No authentication is required: a vulnerable form published on the site is enough.
Why was half the estate out of date?
The 1.56.2 fix shipped on 31 July 2026. A week later, half the installs were still running a vulnerable release.
It is the usual weak link: a site handed to an agency that no longer answers, auto-updates switched off after a regression, a contact form nobody has looked at in three years. The plugin, meanwhile, keeps listening.
Is it the same script from one CMS to the next?
June 2026: unauthenticated file upload in a Magento extension. August 2026: unauthenticated file upload in a WordPress plugin. Same cause, same consequence, two different ecosystems.
This is not a CMS problem. It is an entry point problem: wherever an application accepts a file from outside, validation has to hold. When it does not, what saves you is whatever sits in front.
What should you do today?
Move Forminator Forms to 1.56.2 or later. Then check `wp-content/uploads`: a file dropped before the update is still sitting there.
Forbid PHP execution in upload directories at the web server level. That single measure defuses most upload flaws, whichever plugin is involved.
Who is affected?
- Forminator Forms for WordPress, versions ≤ 1.56.1
- Fixed in version 1.56.2, released 31 July 2026
- CVSS: 9.8 (critical): unauthenticated arbitrary file upload
- Over 600,000 active installs, more than 300,000 still vulnerable at disclosure
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch on the upload endpoint: requests dropping an executable file are refused before WordPress.
- ✓The forged field configuration is detected at the edge, whatever plugin version is installed.
- ✓Coverage spans all your plugins, not only the ones you remembered to watch.
- ✓Useful across the gap between the vendor fix and its rollout onto your sites.
Sources
- Tenable - CVE-2026-15748
- SecurityWeek - 300,000 WordPress sites potentially exposed due to form plugin flaw
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.