Published on 18 August 2026
If you use the popular Forminator Forms plugin on your WordPress website for contact, payment or application forms, you should act now: a critical security flaw allows outside attackers, under certain circumstances, to upload arbitrary files to the server without any authentication – including executable malicious code. In the worst case, this means the complete takeover of the website. According to the WordPress plugin directory, more than 600,000 active installations are affected.
The vulnerability carries the identifier CVE-2026-15748 (a CVE number is a globally unique designation for a specific security flaw) and was published on 17 August 2026 by the security firm Wordfence. On the CVSS severity scale it reaches a score of 9.8 out of 10 – almost the maximum. In this article we explain in plain terms what exactly happened, whether your website is affected and which concrete steps are needed now.
Forminator Forms is a widely used WordPress plugin that lets you build contact forms, payment forms and custom forms without any programming knowledge. The flaw lies precisely in the processing of uploaded files.
Wordfence describes a so-called arbitrary file upload vulnerability – in other words, a flaw through which any files can be uploaded. The crucial point: the attack works without a login. An attacker therefore needs neither an account nor a password. István Márton of Wordfence sums up the risk as follows:
„This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise.“ (Wordfence)
In essence: unauthenticated attackers can upload arbitrary files – including executable PHP files – to a vulnerable website. This can lead to the execution of foreign code on the server (remote code execution) and thus to the complete compromise of the website. PHP is the programming language in which WordPress runs; an uploaded and executed PHP file effectively gives an attacker control over the website.
The flaw is not a simple "open door" but a chain of errors made up of several weaknesses that only become dangerous in combination. Important for context: the attack only works under certain conditions.
According to Wordfence, the flaw is exploitable only when a published form contains both a file upload field and a selection field (select field). The trick: via a manipulated value in the selection field, an attacker can slip a forged configuration for the upload field to the system. The downstream processing then trusts these attacker-controlled values.
Added to this is an insufficient check of the file type. There is actually a blocklist for dangerous file extensions that is supposed to block PHP files, for example. However, this blocklist compares the values exactly, character by character – and can be tricked with an alternative spelling of the MIME/file type designation (MIME type = technical identifier of the file format). This is how the actually forbidden file slips through.
An important safeguard nevertheless normally takes effect: in the default configuration there is an .htaccess file (a server configuration file) in the upload directory that prevents PHP files stored there from being executed at all. According to Wordfence, the particularly dangerous scenario – the actual execution of foreign code – only occurs when a custom file upload storage root is additionally configured in which this protective file is missing. In that case, directly calling the uploaded PHP file can trigger its execution.
These limitations are no reason to sound the all-clear, but merely mean that not every Forminator installation is endangered to the same degree. An update remains mandatory for all users.
Affected are all versions of Forminator Forms up to and including 1.56.1. The flaw was fixed in version 1.56.2. The official changelog in the WordPress plugin directory explicitly notes:
„Fix: Arbitrary file upload vulnerability“ (WordPress.org plugin directory)
On the research day, 17 August 2026, the plugin directory already listed version 1.57.0 as the current version. Anyone updating should therefore go straight to the latest available compatible version and not stop at 1.56.2.
An important note on interpreting the figure of 600,000+: this describes the potentially exposed installations – i.e. how widespread the plugin is, not how many websites were actually attacked or taken over. In the sources reviewed there is no confirmed active exploitation of this flaw and no figure for compromised companies or data records. Wordfence has, however, validated the proof of concept itself – so the danger is real and technically substantiated.
forminator). If the plugin is not installed at all, this particular flaw does not affect you.If Forminator is running on your website, the rule is: act now, don't put it off. We recommend the following steps in this order:
Wordfence expresses the urgency unambiguously:
„We encourage WordPress users to verify that their sites are updated to the latest patched version of Forminator Forms as soon as possible considering the critical nature of this vulnerability.“ (Wordfence)
If you find indications of a successful attack – such as unknown files in the upload directory or unusual website behaviour – initiate an orderly incident process. The BSI (Germany's Federal Office for Information Security) recommends, among other things, in its checklist:
In the event of infections, the BSI generally advises against a merely selective clean-up without comprehensive expertise. When in doubt, you should call in expert help.
The mere existence of the flaw does not yet trigger a reporting obligation. It becomes relevant when a compromise constitutes – or is sufficiently likely to constitute – a breach of the protection of personal data. This is precisely what is likely with forms: via Forminator, contact data, customer enquiries, application documents or file uploads are frequently collected – and in the event of an attack, website access credentials can also be leaked.
Key points:
For breaches of obligations under Art. 25 to 39 – in principle including Art. 32 – Art. 83(4) GDPR provides for a fine framework of up to 10 million euros or 2% of the total worldwide annual turnover of the preceding year, whichever is higher. In addition, Art. 82 GDPR may open up claims for damages by those affected. The actual amount of a sanction always depends on the individual case and cannot be seriously predicted from this flaw.
That inadequate protective measures can in principle be relevant to fines is shown by the 2025 annual report of the Berlin data protection authority, which lists among its fine decisions an "inadequate securing of an email mailbox containing health data". This is not a situation comparable to Forminator, and no fine amount is publicly stated there – but it illustrates that supervisory authorities do sanction inadequate data security.
For small and medium-sized enterprises using Forminator, the flaw is time-critical. The risk is high – because of the CVSS score of 9.8, because no login is required and because in the worst case the entire website can be taken over.
At the same time, the reach is not automatically maximal: the form must contain both a file upload and a selection field, and direct code execution requires the described weakness in custom upload directories. The figure of 600,000+ installations is a prevalence figure, not a victim count. No confirmed active exploitation has so far been reported in the sources reviewed.
For context: back in July 2025, Wordfence reported on another Forminator flaw (CVE-2025-6463) with likewise over 600,000 installations – that time it concerned a conditional file deletion, not a file upload. The fact that Forminator shows up again with a critical vulnerability within a year underlines how important consistent update management is. The security provider Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem for 2025 – 42% more than the previous year, of which, according to its own data, 91% were in plugins.
CVE-2026-15748 is a critical flaw with a clear call to action. The good news: a patch already exists. Check today whether Forminator is running on your website and – after a backup – update without delay to at least version 1.56.2, better to the latest available version. If you cannot update immediately, take risky forms offline temporarily. Check custom upload directories especially carefully and keep in mind that a successful exploitation can also trigger data protection reporting obligations. Those who act swiftly and in an orderly manner close the gate before anyone walks through it.