CVE-2026-15748: critical vulnerability in wpmudev Forminator Forms – Contact Form…
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Published
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 6.1%
from disclosure to weapon0 days
Published on NVDAug 18
1st PoCAug 18
exploitation probability
6.1%top 7% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
public PoCs found — 3
githubgithub.com/yora1928/cve-2026-15748★ 3githubgithub.com/ubaydev/CVE-2026-15748★ 0githubgithub.com/0x4cr/CVE-2026-15748★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — wpmudev Forminator Forms – Contact Form…
In the same product, most dangerous first.
CVE-2025-6463HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionEPSS 15.1%CVE-2023-4596CRITICALForminator <= 1.24.6 - Unauthenticated Arbitrary File UploadEPSS 14.3%CVE-2023-6133MEDIUMForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.9%CVE-2026-92229CRITICALForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' ParameterEPSS 0.7%CVE-2024-7389HIGHForminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information ExposureEPSS 0.7%CVE-2026-5192HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'EPSS 0.6%
References
https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/admin/classes/class-admin-ajax.php#L1196https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/library/abstracts/abstract-class-field.php#L2308https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/library/fields/upload.php#L552https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/library/helpers/helper-fields.php#L3425https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/library/modules/custom-forms/front/front-action.php#L2767https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/library/modules/custom-forms/front/front-action.php#L738https://www.wordfence.com/threat-intel/vulnerabilities/id/263ac05d-f1ca-46e3-a43e-3b45eb8066d4?source=cve