Critical Forminator Flaw Endangers Over 600,000 WordPress Sites

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/4 · Initial Access

An unauthenticated attacker reaches a public Forminator form without any login or account.

T1190 – Exploit Public-Facing Application
  • CVE-2026-15748, CVSS 9.8 (Critical)
  • Affected: Forminator Forms up to and including version 1.56.1
  • 600,000+ potentially exposed active installations
  • Attack works without any authentication
PHASE 2/4 · Defense Evasion

The attacker manipulates the upload configuration and bypasses the file-type check with an alternate spelling.

T1036 – Masquerading
  • Prerequisite: form containing both a file-upload field AND a select field
  • A manipulated value in the select field injects a forged upload configuration
  • Blocklist compares character by character and can be bypassed with an alternate MIME/file-type spelling
  • A normally forbidden PHP file thus slips through the check
PHASE 3/4 · Execution

The uploaded PHP file is called directly and executes attacker code on the server (Remote Code Execution).

T1505.003 – Server Software Component: Web Shell T1059 – Command and Scripting Interpreter
  • Arbitrary file upload allows executable PHP files
  • RCE only with a custom upload storage root lacking the protective .htaccess
  • Default .htaccess in the upload directory normally blocks PHP execution
  • Wordfence validated the Proof of Concept itself
PHASE 4/4 · Impact

In the worst case the attacker fully compromises the entire website.

T1496 – Resource Hijacking
  • Complete compromise of the website possible
  • No confirmed active exploitation in the reviewed sources
  • Fixed in version 1.56.2; latest version on 2026-08-17 was 1.57.0
  • Update mandatory for all users, regardless of form configuration
Short & clear answers
Frequently asked questions about this incident
Am I affected by the Forminator security vulnerability?
All websites running Forminator Forms version 1.56.1 or older are affected. Check the version number in your WordPress backend under Plugins → Installed Plugins. Forms that contain both a file upload field and a select field are especially at risk, but updating is mandatory for all users.
What do I need to do right now?
First, create a full backup of your files and database. Then update Forminator immediately to at least version 1.56.2, ideally to the latest available version (1.57.0 at the time of research), most easily via Dashboard → Updates. Afterwards, verify the version number and test that your important forms still work.
How dangerous is the CVE-2026-15748 vulnerability really?
The vulnerability scores 9.8 out of 10 on the CVSS scale, making it critical. Attackers can upload arbitrary files—including executable PHP code—without any login, which in the worst case leads to a complete site takeover. Wordfence validated the proof of concept itself, but the reviewed sources report no confirmed active exploitation so far.
What can I do if I can't update immediately?
Deactivate affected public-facing forms that contain both an upload and a select field, or temporarily remove them from public access. Also check as a priority whether a custom file upload storage root is configured, as the PHP execution block may be missing there. These measures reduce the attack surface but are explicitly not a substitute for the patch.
How can I tell if my website has already been compromised?
Look for unknown files in the upload directory or unusual website behavior. If you suspect a compromise, start an orderly incident response process. The German BSI's technical checklist for IT security incidents provides useful guidance.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.