---
schema: 1
kind: vulnerability
title: "CVE-2026-15748 — Forminator Forms (600,000+ WordPress sites): a forged Select-field value overrides the upload allow-list, and the root cause went public seventeen days after the patch (CVSS 9.8)"
headline: "The blocklist matches MIME keys exactly, so a pipe-alternative key walks a PHP file past it"
summary: >
  Wordfence published the root cause of CVE-2026-15748 on 2026-08-17, an unauthenticated arbitrary-file-upload
  flaw in the Forminator Forms plugin for WordPress affecting all versions up to and including 1.56.1 —
  600,000+ active installs, CVSS 9.8, Wordfence acting as CVE Naming Authority. The plugin's
  handle_file_upload function screens uploads against a dangerous-extension blocklist that matches MIME-type
  keys exactly, so a pipe-alternative key is not matched, and a forged Select-field value lets an
  unauthenticated submitter override the upload field's own type configuration — together yielding a PHP file
  on disk and remote code execution. Exploitable only on forms carrying both a File Upload field and a Select
  field. Patched in 1.56.2 on 2026-07-31; neither Wordfence nor the Swiss advisory reports any observed exploitation, and the advisory records the exploitation status for its whole bundle as unknown. Switzerland's NCSC put the disclosure
  in front of its constituency on 2026-08-18.
discovered_at: "2026-08-19T05:25:00Z"
event_date: "2026-08-17"
run_id: 2026-08-19T0410Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global, europe, switzerland]
sectors: [public-sector, education, technology]
entities: []
techniques: [T1190, T1505.003]
affected_products: ["WPMU DEV Forminator Forms"]
cves:
  - id: CVE-2026-15748
    cvss: "9.8"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Forminator Forms ≤ 1.56.1"
    fixed: "1.56.2 (released 2026-07-31)"
sources:
  - url: "https://security-hub.ncsc.admin.ch/#/posts/12860"
    publisher: "NCSC-CH Cyber Security Hub"
    date: "2026-08-18"
    role: primary
  - url: "https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html"
    publisher: "The Hacker News (quoting Wordfence)"
    date: "2026-08-17"
    role: corroborating
  - url: "https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864"
    publisher: "malware.news (verbatim syndication of the Wordfence Intelligence post)"
    date: "2026-08-17"
    role: corroborating
closed_sources: []
evidence:
  - quote: "The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function."
    publisher: "Wordfence Intelligence"
  - quote: "the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value."
    publisher: "Wordfence Intelligence"
  - quote: "The vulnerability is only exploitable on sites that have a form containing both a File Upload field and a Select field."
    publisher: "Wordfence Intelligence"
  - quote: "if an administrator has configured a Custom File Upload Storage root, that root can end up without the .htaccess protection because it is created only when it is first needed"
    publisher: "Wordfence Intelligence"
verification: multi-source
sourcing_note: >
  Wordfence is the discovering researcher's programme operator and the CVE Naming Authority for this record,
  so it is the single assessor behind the mechanism — wordfence.com itself refused every transport available
  this run (WebFetch returned an empty body, the direct bridge an anti-bot challenge shell, and the reader
  proxy is credit-exhausted), so its text is quoted from a syndication feed that reproduces the post verbatim,
  cross-checked against the CVE description Wordfence supplied as CNA and against The Hacker News quoting
  Wordfence directly. Switzerland's NCSC is cited as the primary because it is a national authority
  publishing to this constituency, and it is the reason the item is in window; its own advisory records the
  exploitation status for the bundle as unknown. Credibility is 2 rather than 1 because the several
  publishers here relay one assessor rather than corroborate it independently. The literal payload pattern
  Wordfence publishes is deliberately omitted. One inconsistency inside that source is recorded rather than
  silently resolved: its opening paragraph dates the bug-bounty submission to 14 July while its own
  structured disclosure timeline dates it to 11 July, with 14 July given as validation and vendor
  disclosure. This entry follows the structured timeline, which is the more specific of the two and is
  internally consistent with the remaining dates.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Inventory WordPress sites running Forminator Forms, update any at or below 1.56.1 to 1.56.2 or later, and for sites that were exposed since 2026-07-31 check whether any form combines a File Upload field with a Select field — that pairing is the precondition and tells you which sites were actually reachable."
  - "On any Forminator site configured with a Custom File Upload Storage root, verify that directory carries the .htaccess file blocking PHP execution; Wordfence states the protection can be missing there even though the default upload path has it."
migrated_from: null
---

Wordfence published the technical write-up for CVE-2026-15748 on 2026-08-17, seventeen days after the fix shipped, and Switzerland's NCSC relayed the disclosure to its own constituency the following day alongside three other WordPress plugin flaws ([NCSC-CH Cyber Security Hub, 2026-08-18](https://security-hub.ncsc.admin.ch/#/posts/12860)). The flaw affects the Forminator Forms plugin, which carries more than 600,000 active installs, and it is rated CVSS 9.8 with Wordfence acting as CVE Naming Authority: "The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function" ([Wordfence Intelligence, 2026-08-17](https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864)).

The mechanism is two defects meeting. The upload screen is a blocklist of dangerous extensions matched against MIME-type keys, and it compares those keys exactly — so a key expressed in pipe-alternative form is simply not found in the list and the file passes. Separately, the public submission handler trusts the upload field's type configuration as submitted, which means a forged value in a Select field on the same form can rewrite what the upload field is willing to accept. Wordfence's own description puts both halves together: the blocklist "performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value" ([Wordfence Intelligence, 2026-08-17](https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864)). The consequence is a PHP file written into the site and executed — full site compromise, with no authentication required. The concrete payload pattern Wordfence publishes is omitted here.

Two preconditions decide which of those 600,000 sites actually matter, and they are unusually easy to check. First, the form itself: "The vulnerability is only exploitable on sites that have a form containing both a File Upload field and a Select field" ([Wordfence Intelligence, 2026-08-17](https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864)) — an installation with no such form is not reachable by this path, which turns a plugin-version sweep into a much smaller, form-level triage. Second, and cutting the other way, the built-in mitigation is not always present. By default uploads land in a directory whose `.htaccess` file blocks PHP execution, but Wordfence notes that "if an administrator has configured a Custom File Upload Storage root, that root can end up without the .htaccess protection because it is created only when it is first needed" during a frontend request where the helper that writes that file is not loaded ([Wordfence Intelligence, 2026-08-17](https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864)). A site that looks hardened by default configuration may not be, and the deciding factor is an administrator setting rather than the plugin version.

The timeline is what puts this in scope now rather than in July. Wordfence's published timeline records the submission from the researcher credited as daroo arriving through its bug-bounty programme on 2026-07-11, validation and full disclosure to the vendor on 2026-07-14, the vendor submitting a patch for review on 2026-07-20, release of the fully patched 1.56.2 on 2026-07-31, and the root-cause write-up on 2026-08-17 ([Wordfence Intelligence, 2026-08-17](https://malware.news/t/600-000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/124864)). Neither Wordfence's post nor the Swiss advisory reports observed exploitation — Wordfence makes no statement either way about attempts in the wild, and NCSC-CH records the exploitation status for its whole four-CVE bundle as unknown ([NCSC-CH Cyber Security Hub, 2026-08-18](https://security-hub.ncsc.admin.ch/#/posts/12860)). That absence is not reassurance here: the mechanism is now public in enough detail to rebuild, the affected estate is large, publicly enumerable and largely unmanaged, and WordPress plugin flaws of this class are routinely mass-scanned within days of a write-up. This pipeline has already covered Swiss websites compromised through a WordPress chain and repurposed to serve paste-and-run lures, so the downstream consequence for this constituency is not theoretical.

Detection concentrates on the file-system outcome, because the request that produces it is an ordinary form submission. In web and file-integrity telemetry, the durable signals are new or modified `.php` files appearing anywhere under the WordPress root — especially inside upload directories, which should never contain executable code — and subsequent direct HTTP requests to those paths, which is the step that turns an uploaded file into execution. In access logs, POST submissions to the plugin's public form-submission endpoint followed within seconds by a GET to a newly created path under the uploads tree is the sequence worth alerting on. **Triage:** legitimate form traffic uploads files to those same directories all day, so an upload event alone is meaningless — the discriminators are the file extension, whether the file is subsequently requested directly rather than only referenced by an administrator viewing the submission, and whether the storage directory carries its execution-blocking configuration. Hardening beyond the update is the same control the default configuration already relies on: ensure PHP execution is blocked in every directory that receives uploads, including any custom storage root.