Wordfence discloses 9.8-rated Forminator flaw with 600,000 installations allowing remote code execution
This digest was compiled by AI from multiple sources — links to the originals are below.
Wordfence discloses a critical flaw, CVE-2026-15748, in the Forminator Forms WordPress plugin, installed on more than 600,000 sites, that allows unauthenticated attackers to upload PHP files and execute code. The vulnerability is fixed in version 1.56.2 released July 31, 2026, but exploitation requires a form with both a File Upload and a Select field. Wordfence also discloses a separate 9.8-rated authentication bypass in User Profile Builder, patched July 16, 2026, affecting more than 40,000 installations.
Key Facts
- CVE-2026-15748 in Forminator Forms is rated 9.8 on the CVSS scale and allows unauthenticated attackers to upload executable PHP files.
- The vulnerability affects all plugin versions up to and including 1.56.1 and was fixed in version 1.56.2 released July 31, 2026.
- Exploitation requires a form that contains both a File Upload field and a Select field.
- Wordfence also disclosed CVE-2026-15826, a 9.8-rated authentication bypass in User Profile Builder, patched July 16, 2026 in version 3.16.5.
- The User Profile Builder flaw could allow unauthenticated attackers to log in as user ID 1, typically the site administrator.
Forminator Remote Code Execution Flaw
CVE-2026-15748, discovered by researcher "daroo", resides in the handle_file_upload() function and stems from insufficient file type validation in user-supplied input. An unauthenticated attacker can submit a form to upload any file, including a specially crafted PHP file, and achieve remote code execution and site takeover. Exploitation requires the target site to have a form containing both a File Upload field and a Select field. In the default configuration, uploaded files land in a directory protected by an .htaccess file that prevents PHP execution, but a custom File Upload Storage root may not carry that safeguard. Requesting the uploaded file is enough for the web server to execute attacker-controlled PHP code.
User Profile Builder Authentication Bypass
Wordfence also disclosed CVE-2026-15826, a 9.8-rated authentication bypass in the User Profile Builder plugin, which has more than 40,000 active installations. The flaw could allow unauthenticated attackers to log in as the user with ID 1, typically the site administrator, and take over the site. It was patched on July 16, 2026 with the release of version 3.16.5.
1 source
Wordfence discloses 9.8-rated Forminator flaw with 600,000 installations allowing remote code execution
