CVE-2026-15748 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in Forminator Forms, the form builder plugin running on more than 300,000 WordPress sites. It affects every version up to and including 1.56.1, is fixed in 1.56.2, and requires no authentication or user interaction to exploit. If you use Forminator for any public-facing form, this is worth checking today.
How the Bypass Actually Works
The vulnerability lives in Forminator’s handle_file_upload function. Two separate weaknesses combine to make it exploitable: the plugin’s dangerous-extension blocklist does an exact-key match that a pipe-alternative MIME type value can slip past, and the public submission handler trusts upload field configuration that’s supposed to come from the form builder — but can instead be forged by an attacker as part of a Select field’s value. Combine a crafted Select field with a forged upload configuration and the file-type check never properly applies, letting a PHP file through as if it were an allowed type.
Who’s Affected
| Version | Status |
|---|---|
| 1.56.1 and earlier | Vulnerable — update immediately |
| 1.56.2 or later | Patched |
What to Do
- Update Forminator Forms to 1.56.2 or later right away.
- Review any form combining a file-upload field and a Select field specifically — that’s the exact combination the exploit chain relies on.
- Audit your uploads directory for unexpected
.phpfiles. Legitimate form uploads are never PHP. - Confirm any custom upload directories have
.htaccessprotection preventing direct PHP execution, as defense-in-depth beyond the plugin fix itself.
If You Find a Webshell
Updating closes the vulnerability going forward but doesn’t remove a file that was already uploaded before you patched. An unfamiliar PHP file in your uploads folder means active compromise, not just exposure — treat it as an incident, not a cleanup task. We cover the actual recovery process in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. If you’d like a site checked directly, get in touch.
Frequently Asked Questions
Am I affected if my Forminator forms don’t have a file upload field?
The direct exploit path needs a form with a file-upload field, so your immediate exposure is lower without one. Still update promptly, since a form can be edited to add one at any time and the vulnerable code ships regardless.
Is this the same bug as the Elementor Pro or Checkout Field Manager file-upload CVEs?
No — each is a distinct vulnerability in a different plugin, though the general pattern (an unauthenticated file-upload path that doesn’t properly validate file type) is a recurring category across form and checkout-field plugins.
Does updating alone fix a site that was already exploited?
No. Updating stops new exploitation but doesn’t remove a webshell already planted. If your site ran a vulnerable version for any length of time, check uploads and admin accounts before considering it resolved.
Featured image: original illustration.