Forminator Plugin Vulnerability: A Five-Step Checklist for WordPress Site Owners

Does your WordPress site collect file uploads through a contact or application form? Check one thing today: whether it uses the Forminator plugin, and which version. A newly disclosed Forminator plugin vulnerability lets an attacker upload and run malicious code. No login is needed. It is rated 9.8 out of 10 for severity.

What the Forminator plugin vulnerability actually does

Forminator is a form-builder plugin. It runs on more than 600,000 WordPress sites. Businesses use it for contact forms, job application forms and payment forms. Researchers found a way to abuse its file-upload feature. The flaw is tracked as CVE-2026-15748. It lets an attacker smuggle a PHP script past the plugin’s own file checks. Once uploaded, that script can run on the server. That hands the attacker control of the site.

WPMU DEV makes Forminator. The company patched the flaw in version 1.56.2 on 31 July 2026. A follow-up release, 1.57.0, arrived less than two weeks later. Every version up to 1.56.1 is vulnerable. No account on the target site is required to exploit it.

How attackers get past the file-type check

Forminator blocks dangerous file extensions like .php. It uses a list of banned types. The problem, as documented by Wordfence and reported by The Hacker News, is that the check matched extensions exactly. It did not account for variation. An attacker could write the file’s MIME type in a slightly different format. The list did not recognise it, so the file walked straight past.

There is a second weakness. The upload handler is public by design, since visitors reach it without an account. But it also trusted a piece of form configuration a visitor could tamper with: a Select field value that tells the handler what kind of upload to expect. Forge that value, disguise the file, and the upload sails through as if it were a harmless document.

This only works on forms that pair a File Upload field with a Select field. It only leads to code execution if the destination folder lacks server rules that stop PHP files running. Neither condition is unusual on a typical small business site. That is why so many installations are realistically exposed, not just technically in scope.

What a successful attack looks like

The Forminator plugin vulnerability does not stop at the upload. Once an attacker’s PHP file runs, they are not limited to the form itself. A web shell like this usually gives full control of the site. Attackers can create a hidden admin account, copy the database, including other form submissions, plant further malware, or host spam and phishing pages under your domain’s name.

For a small or mid-sized business, the real damage rarely comes from the upload itself. It comes later, if nobody notices. Search engines start flagging the site. A host suspends the account. A customer’s details from a job application turn up somewhere they should not. None of that needs a skilled attacker. Automated scanners already probe for outdated WordPress plugins within hours of a CVE going public, so this will not stay a niche technical curiosity for long.

A five-step checklist

1. First, log into WordPress and open the Plugins page. Find Forminator and note the version shown. That number tells you if the Forminator plugin vulnerability applies to your site.

2. If it reads 1.56.1 or earlier, update it now. Version 1.56.2 or 1.57.0 both include the fix.

3. While you wait for the update, or if updates are manual on your site, find any form that pairs a File Upload field with a Select field. Disable it for now.

4. Ask whoever manages your hosting whether upload folders block PHP execution. This one server setting would have stopped the attack even without the patch. It is worth having regardless of which form plugin you run.

5. Check the uploads folder for files that do not belong there, especially anything with a .php extension mixed in among images or documents. If you find one, treat the site as compromised. Bring in help to investigate properly. A single visible file rarely tells you what else an attacker changed.

Why this keeps happening

File upload features are some of the riskiest things a website can offer the public. They ask software to trust a stranger’s file. Plugins try to defend that trust with checks like block lists. But a block list only covers what its author thought of. A specific penetration test finding, or a researcher poking at edge cases, is often what surfaces the gap. That is what happened here. A researcher going by “daroo” found the exact-match flaw and reported it through Wordfence, rather than an attacker finding it first.

If your business takes uploads from customers, applicants or suppliers, this is a good moment to ask a harder question. Not just “is Forminator patched”, but “what else on this site accepts a file from someone we have never met, and has anyone actually tested it?” A patch fixes today’s Forminator plugin vulnerability. A server that blocks PHP execution in upload folders, and a habit of checking plugin versions on a schedule rather than only after a headline, will catch the next one too.