Arbitrary File Upload in Forminator Forms Plugin for WordPress

The Forminator Forms plugin for WordPress is vulnerable to an arbitrary file upload flaw (CVE-2026-15748) affecting all versions up to and including 1.56.1. The vulnerability resides in the handle_file_upload function, which utilizes a flawed blocklist for file extension validation. Attackers can bypass these security checks by employing pipe-alternative MIME type keys. Because the public submission handler trusts attacker-supplied configuration, a user can forge a Select field value to manipulate upload parameters. This allows unauthenticated attackers to bypass intended restrictions and upload malicious, potentially executable files to the web server, leading to full remote code execution (RCE). Given the nature of the vulnerability and the popularity of the plugin, immediate patching to version 1.56.2 or higher is required.

Impact

Successful exploitation of CVE-2026-15748 grants unauthenticated remote code execution on the underlying web server. This provides an attacker with complete control over the WordPress instance, enabling data theft, site defacement, or persistence within the environment.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the Forminator Forms plugin to version 1.56.2 or later immediately to patch CVE-2026-15748.
• Audit web server access logs for anomalous POST requests to plugin-specific form submission endpoints that include unexpected file extensions or suspicious MIME type configurations.
• Monitor for newly created files within the WordPress uploads directory, specifically focusing on .php, .phtml, or .phar files.
• Deploy web application firewall (WAF) rules to restrict file uploads through Forminator endpoints, specifically looking for attempts to manipulate hidden form fields or MIME type parameters in POST bodies.