If you're running Forminator Forms on your WordPress site, you need to update right now. A researcher found a way for anyone to upload malicious files without logging in. The bug is serious enough that it got a CVSS score of 9.8 out of 10.
The vulnerability is tracked as CVE-2026-15748. It affects every version of the plugin up to 1.56.1. The fix was made available on 31st July 2026 in version 1.56.2. If you haven't updated yet, your site is at risk.
Wordfence, a security company that specializes in WordPress, published the details. They said attackers can upload PHP files and execute them on your server. That means they can take over your entire site. No username needed. No password required.
Here is an explanation of what is happening with the Forminator Forms vulnerability and how to deal with it.
The Problem
It is about the process through which Forminator allows file uploads on its site. The handle_file_upload() function is not filtering file types effectively when uploading files by users.
There are specific types of dangerous files which the plugin keeps track of and attempts to block. But the way it checks that list isn't good enough. Attackers can trick it into accepting any file they want.
For this to work, they will require a form with the following two fields:
- File Upload field
- Select field
Should your website have such a form that incorporates both fields, then you have fallen victim to this vulnerability where the attacker simply fills the form and uploads a malicious PHP file, and the plugin accepts it.
The .htaccess Catch
There's a twist that makes this even worse.
By default, Forminator uploads files to a folder that's protected by an .htaccess file. That file prevents PHP from running in that folder. Good, right?
But if you've set up a custom upload location, that protection might not be there. The .htaccess file only gets created when it's first needed. And if an attacker uploads a file during a frontend request, that protection might not have been set up yet.
So the attacker uploads their PHP file, requests it directly, and boom their code runs on your server.
What Happens Next
Once the attacker has code execution, they can do just about anything:
- Steal your database
- Deface your site
- Install backdoors
- Use your server to attack others
It's a complete compromise. And they didn't need a single password to get there.
The Fix
The good news is that the Forminator team already patched this. Version 1.56.2 fixes the problem. If you're running any earlier version, you need to update.
Go to your WordPress dashboard, check for plugin updates, and update Forminator right now. Don't wait.
If you're using a custom upload folder, double-check that the .htaccess protection is in place. Better yet, stick with the default storage location unless you really need something different.
Another Plugin with a Similar Issue
While we're on the subject of plugin vulnerabilities, there's another one you should know about.
User Profile Builder has a critical bug tracked as CVE-2026-15826. It also has a 9.8 CVSS score. The issue lets attackers log in as the site administrator without a password.
The vulnerability occurs in the wppb_log_in_user() function. If the user tries to create an account using the username length ranging from 61 to 70 characters, WordPress will not allow it. However, the plug-in does not handle the rejection properly. Instead, it grants access to user ID 1- the admin account.
This only works if the Automatically Log In setting is turned on. If you're not using that feature, you're safe. But if you are, update to version 3.16.5 immediately.
Bottom Line
Two popular WordPress plugins had critical security holes. Both are fixed now. Both require you to update.
- Forminator Forms: Update to 1.56.2
- User Profile Builder: Update to 3.16.5
Check your sites. Update your plugins. And if you have custom upload folders set up, make sure they're protected.
These vulnerabilities let attackers take over your site without any credentials. That's as bad as it gets. Don't leave the door open.
FAQ Section
What is the Forminator Forms vulnerability?
CVE-2026-15748 is a file upload bug that lets unauthenticated attackers upload PHP files and execute code on your server.
Which versions are affected?
Versions up to 1.56.1 are vulnerable. Version 1.56.2 fixes the issue.
What does an attacker need to exploit this?
Both the File Upload and Select fields should be there.
How does User Profile Builder stand in the matter?
CVE-2026-15826 is an authorization bypass flaw that makes it possible for the attacker to access the admin panel. Upgrade to v3.16.5.
What should I do?
Update both plugins immediately. Check your custom upload storage settings.
