Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical vulnerability, CVE-2026-15748, exists in the Forminator Forms WordPress plugin that allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution on vulnerable sites. The flaw affects all versions prior to and including 1.56.1 and stems from insufficient file type validation in the 'handle_file_upload()' function, which can be bypassed using alternative MIME types. Exploitation is possible when a form contains both a File Upload and a Select field, and custom upload directories without proper .htaccess protection increase the risk of successful code execution.

AI-extracted · verify before operational use