Forminator Forms is installed on more than 600,000 WordPress sites. A critical security flaw has just been disclosed, and the scary version of the headline is simple: no login, malicious file upload, possible control of the server.
The accurate version needs another minute.
CVE-2026-15748 has a CVSS score of 9.8 and affects Forminator 1.56.1 and older. The fix is in version 1.56.2. An attacker can abuse a vulnerable public form to upload a file that Forminator should reject, including a PHP file. If that file lands somewhere the server will execute it, the attacker can run code and take over the site.
Bad. But not every one of those 600,000 installations is equally exposed. Let’s separate the real conditions from the noise.
The form needs a specific combination
The vulnerable route needs a Forminator form containing both a File Upload field and a Select field – the dropdown where a visitor chooses one option from a list. The attacker forges the Select value so Forminator trusts a file configuration it should never have accepted. That gets around the plugin’s dangerous-file checks.
No WordPress account is required. No administrator has to click a link. The attacker submits the public form like any other visitor, only with a carefully altered request.
If you use Forminator only for a basic name, email, and message form, this exact path does not match your setup. If customers upload CVs, insurance documents, project files, screenshots, or application forms with dropdown choices, check it now. Those are normal small-business uses, which is exactly why this matters.
A vulnerability scanner should identify the affected plugin version. It cannot tell you whether a particular form contains both fields, though. That part needs a look inside Forminator.
Upload does not always mean code execution
Here is the second condition that gets lost in most headlines. Forminator’s default upload directory contains protection intended to stop PHP files from executing. The more dangerous setup is a Custom File Upload Storage location where the same protection may not exist.
That means the bug can allow an arbitrary upload without every successful upload becoming instant remote code execution. For full RCE, the uploaded PHP file must land in a location where the web server will actually run it.
This is not a reason to relax. An arbitrary file upload is serious on its own, and server configurations differ. It is a reason to describe the risk honestly. According to the technical details reported by SecurityWeek, custom upload storage is the clearest route to executable PHP.
The plugin has more than 600,000 active installations. Public version data suggested roughly half were still running an affected release when the story broke. So the useful number is not “600,000 hacked sites.” It is hundreds of thousands of sites that need someone to check a version number.
The patch came before the public explanation
Forminator 1.56.2 shipped in late July with a short changelog entry: “Fix: Arbitrary file upload vulnerability.” The detailed disclosure arrived on August 17, followed by the CVE record.
That timing is good. It gave attentive site owners a chance to update before the full mechanism was public. It also means the risk changes once the write-up appears. Attackers no longer need to discover the bug from scratch; they can compare the old and new code and work backwards.
As of August 19, there are no confirmed reports of exploitation in the wild and no verified public proof of concept. Good. Use that window. Waiting until scanners are visibly hammering forms is a much worse maintenance plan.
This is the same practical lesson as the recent WordPress 7.0.4 security release: a patch is most useful before your site becomes the case study.
What to check today
- Check the plugin version. If Forminator is 1.56.1 or older, update to 1.56.2 or later immediately.
- Open every Forminator form. Prioritise forms containing both File Upload and Select fields.
- Check upload storage. Look for a custom upload path and confirm that PHP execution is blocked there.
- Inspect recent uploads. Search Forminator upload folders and custom storage locations for unexpected
.php,.phtml, or unfamiliar files. - Review activity. Look for new administrator accounts, recently installed plugins, and unexplained file changes.
Updating is the first step, not proof that the site was clean beforehand. If a malicious file arrived before the patch, installing 1.56.2 does not remove it. File integrity monitoring can help spot unexpected additions and changes, provided the upload location is included in its coverage.
For sites under regular WordPress maintenance, this is the kind of update that should move ahead of routine work. Patch the plugin, inspect the relevant forms, and verify the upload path. Done. Boring is good.
If you find something suspicious
Don’t delete the first strange PHP file and declare victory. Save a snapshot first. Record the path and modification time. Check the web-server logs around that time, then look for related admin accounts, plugins, scheduled tasks, and other changed files.
Our guide on what to do when you suspect a compromise covers the first response without destroying useful evidence. If code has already executed, treat it as a full hacked WordPress cleanup, not a one-file problem.
That distinction matters. A webshell is usually the door, not the whole house. Once an attacker can run PHP, they can create persistence somewhere completely unrelated to Forminator.
The short version
Forminator 1.56.1 and older contains a critical unauthenticated file-upload vulnerability. The clearest attack path needs a form with both File Upload and Select fields. Remote code execution also depends on the uploaded file reaching a location where PHP can run, with custom upload storage being the main concern.
Update to 1.56.2 or newer. Check the forms. Check the upload directories. And do it while this is still a warning, not a cleanup job.