Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

CVE-2026-15748 is an unauthenticated arbitrary file upload in the Forminator Forms WordPress plugin (all versions ≤ 1.56.1, 600,000+ active installs). The flaw chains two weaknesses: the plugin's sanitizer returns nested Select field values unchanged, letting an attacker smuggle a fabricated upload record through a Select field that declares itself a File Upload field with attacker-controlled configuration. The extension blocklist uses exact-key matching, which is bypassed by pipe-alternative MIME type keys — so .php files slip past the filter while WordPress still treats them as executable PHP. The result is a webshell dropped by an unauthenticated visitor submitting a crafted form. Exploitation requires the target form to contain both a File Upload field and a Select field, a common pairing in contact and application forms.

The vendor rated this CRITICAL at 9.8, which accurately reflects the *theoretical* worst case: unauth, no interaction, full RCE. However, the vendor score ignores a significant real-world friction point — default Forminator installations deploy .htaccess rules in the upload directory that block PHP execution. Only sites using a custom upload storage root that lacks this protection are exploitable for code execution. That narrows the immediately-exploitable population below the full 600K install base. noisgate downgrades to HIGH (8.6) to reflect this default-safe posture while acknowledging the attack surface remains enormous for misconfigured or custom-hosted deployments.

Why this verdict

• Default .htaccess friction: Standard Forminator installs deploy .htaccess rules blocking PHP execution in the upload directory. The file uploads successfully, but the RCE kill chain breaks at the execution step. This is the primary downgrade driver from CRITICAL to HIGH.
• Form configuration prerequisite: Exploitation requires a form with both a File Upload field and a Select field. While this is a common pairing (contact forms, job applications), it is not universal — simple newsletter or feedback forms are unaffected, narrowing the exploitable subset.
• No public PoC and no confirmed exploitation: As of 2026-08-18, no public exploit code exists and no in-the-wild activity has been reported. The patch diff makes weaponization feasible for skilled attackers within days to weeks, but the current threat is potential, not active.
• Role multiplier: WordPress is canonically internet-facing web infrastructure. (a) *Low-value role:* dev/staging WordPress — compromise is contained, blast radius is host-level. (b) *Typical role:* production marketing/content site — compromise yields customer data, defacement, SEO spam, or lateral pivot into internal networks via shared hosting or VPN credentials in wp-config.php. Blast radius is host-to-tenant. (c) *High-value role:* e-commerce sites (WooCommerce), SaaS landing pages with payment integrations, multi-site networks where a single WordPress instance hosts dozens of tenants. Blast radius is tenant-to-fleet for multi-site, and includes PCI-scoped data for e-commerce. WordPress is NOT a DC, hypervisor, or IdP, so the high-value-role floor does not mandate CRITICAL — but it firmly supports HIGH given the internet-facing exposure and data-handling role.
• Unauth + no interaction + internet-facing = large reachable population: The CVSS vector (AV:N/AC:L/PR:N/UI:N) is accurate for the network access component. Every site running a vulnerable form is reachable without any prior access, which prevents downgrade below HIGH.

Why not higher?

The default .htaccess protection in Forminator's upload directory blocks PHP execution on standard installations, breaking the RCE chain at the most critical step. Without hard data showing that a majority of the 600K installs use custom upload roots, the exploitable population is a *subset* of the total install base. Additionally, no public PoC or active exploitation has been confirmed, reducing the immediate threat urgency below CRITICAL.

Why not lower?

The vulnerability is unauthenticated, requires no user interaction, targets internet-facing infrastructure with 600K+ installs, and achieves full RCE when the .htaccess protection is absent. The form configuration prerequisite (Upload + Select fields) is common enough in real deployments that it does not meaningfully narrow the attack surface below the HIGH threshold. Managed hosting and Nginx deployments without equivalent deny rules may also lack the .htaccess safeguard, expanding the vulnerable population beyond just explicitly custom-configured installs.

1. Disable or remove File Upload fields from forms with Select fields — Eliminating the field combination prerequisite completely neutralizes the attack vector. Review all Forminator forms and remove the Upload field or the Select field where both aren't strictly required. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Restrict PHP execution in upload directories at the web server level — For Apache, verify .htaccess in wp-content/uploads/ contains php_flag engine off or equivalent <FilesMatch> deny rule. For Nginx, add location ~* /uploads/.*\.php$ { deny all; } to the site config. This blocks RCE even if the file upload succeeds. Deploy within 30 days.
3. Deploy WAF rules blocking multipart uploads with PHP extensions to Forminator endpoints — Configure Cloudflare, ModSecurity, or Sucuri to inspect POST requests to /wp-admin/admin-ajax.php?action=forminator_submit_form_* and block payloads containing .php, .phtml, .phar file extensions in upload fields. This catches the exploit at the network edge.
4. Enable file integrity monitoring on wp-content/uploads/ — Deploy FIM (OSSEC, Wazuh, or Tripwire) to alert on new .php file creation in upload directories. This provides detection-in-depth if the upload succeeds but execution is blocked.

Run this on each WordPress host (or via SSH across your fleet) as a user with read access to the WordPress plugins directory. Example: bash check_forminator.sh /var/www/html

#!/bin/bash
# CVE-2026-15748 - Forminator Forms Arbitrary File Upload Check
# Usage: bash check_forminator.sh <wordpress_root>
# Requires: read access to WordPress plugins directory
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

WP_ROOT="${1:-.}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/forminator"
MAIN_FILE="$PLUGIN_DIR/forminator.php"

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "UNKNOWN - Forminator plugin not found at $PLUGIN_DIR"
  exit 2
fi

if [ ! -f "$MAIN_FILE" ]; then
  echo "UNKNOWN - Cannot read $MAIN_FILE"
  exit 2
fi

# Extract version from plugin header
VERSION=$(grep -i 'Version:' "$MAIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine Forminator version"
  exit 2
fi

echo "Detected Forminator version: $VERSION"

# Compare versions - 1.56.2 is the fix
# Using sort -V for version comparison
MIN_SAFE="1.56.2"
SORTED=$(printf '%s\n%s' "$VERSION" "$MIN_SAFE" | sort -V | head -1)

if [ "$SORTED" = "$MIN_SAFE" ] || [ "$VERSION" = "$MIN_SAFE" ]; then
  # Version >= 1.56.2
  if [ "$VERSION" = "$MIN_SAFE" ] || [ "$SORTED" = "$MIN_SAFE" ]; then
    echo "PATCHED - Forminator $VERSION >= $MIN_SAFE"
    # Also check htaccess as bonus
    UPLOAD_DIR="$WP_ROOT/wp-content/uploads/forminator"
    if [ -d "$UPLOAD_DIR" ] && [ ! -f "$UPLOAD_DIR/.htaccess" ]; then
      echo "WARNING - Upload directory exists but lacks .htaccess protection: $UPLOAD_DIR"
    fi
    exit 0
  fi
fi

# Version < 1.56.2
echo "VULNERABLE - Forminator $VERSION < $MIN_SAFE (CVE-2026-15748)"

# Check for htaccess mitigation
UPLOAD_DIR="$WP_ROOT/wp-content/uploads/forminator"
if [ -d "$UPLOAD_DIR" ]; then
  if [ -f "$UPLOAD_DIR/.htaccess" ]; then
    echo "NOTE - .htaccess present in upload dir (default protection may block RCE)"
  else
    echo "CRITICAL - No .htaccess in upload dir - RCE is likely exploitable"
  fi
fi

exit 1

Sources

1. The Hacker News - Forminator WordPress Flaw Enables Unauthenticated RCE
2. SecurityOnline - CVE-2026-15748 Analysis
3. Patchstack - Critical Arbitrary File Upload Patched in Forminator
4. Wordfence - Forminator Vulnerability Intelligence
5. CyberSecurityNews - Critical WordPress Plugin Vulnerability
6. WPScan - Forminator Plugin Vulnerabilities
7. FIRST - EPSS Scoring System