A critical security vulnerability has been disclosed in the Forminator Forms WordPress plugin that could allow unauthenticated attackers to execute arbitrary code on vulnerable websites. The plugin, which has more than 600,000 active installations, is affected by the flaw tracked as CVE 2026 15748 and assigned a CVSS score of 9.8 out of 10. The issue was discovered and reported by a security researcher using the online alias daroo. According to cybersecurity company Wordfence, the vulnerability allows attackers to upload arbitrary files, including executable PHP files, potentially leading to remote code execution and complete compromise of affected websites. The flaw impacts all versions of Forminator before and including version 1.56.1 and has been addressed in version 1.56.2, which was released on July 31, 2026.
Wordfence explained that successful exploitation requires a website to use a Forminator form containing both a File Upload field and a Select field. The vulnerability exists within the handle_file_upload() function because of insufficient validation of uploaded file types. According to the security company, the dangerous extension blocklist performs exact key matching that can be bypassed using alternative MIME type keys combined with attacker controlled upload field configuration injected through a forged Select field value. This allows an unauthenticated attacker to upload arbitrary files, including specially crafted PHP files, through a public form submission and achieve remote code execution on the target server. Once the malicious PHP file is executed, attackers could gain complete control over the affected website. Wordfence also highlighted an important deployment detail regarding the vulnerability. Under the default configuration, uploaded files are stored in a directory protected by an .htaccess file that prevents PHP execution. However, if a site administrator has configured a custom file upload storage location, the required protective .htaccess file may not be created because the WordPress helper responsible for generating it is unavailable during the relevant frontend request. In such cases, simply accessing the uploaded file could cause the web server to execute the attacker supplied PHP code.
The disclosure comes shortly after Wordfence identified another critical vulnerability affecting the User Profile Builder WordPress plugin, which is installed on more than 40,000 websites. That flaw, tracked as CVE 2026 15826 and also assigned a CVSS score of 9.8, could allow unauthenticated attackers to bypass authentication and log in as the website administrator, typically associated with user ID 1. The vulnerability affects all plugin versions before 3.16.5 and was patched on July 16, 2026. According to Wordfence, exploitation is only possible when the Automatically Log In feature is enabled. The issue originates from the wppb_log_in_user() function, where the return value of wp_insert_user() is passed through absint() before an is_wp_error() validation is performed. When a registration request uses a username between 61 and 70 characters long, WordPress generates a WP_Error object. However, the plugin converts that object into the integer value 1 before checking for the error, resulting in an automatically generated login token associated with the administrator account.
Wordfence warned that the authentication bypass flaw could enable unauthenticated attackers to gain full administrative control of affected websites without valid credentials. Combined with the recently disclosed Forminator vulnerability, the findings highlight how weaknesses in popular WordPress plugins can expose websites to serious security risks if updates are not applied promptly. Website administrators using either Forminator Forms or User Profile Builder are advised to install the latest available versions to address the vulnerabilities and verify that their WordPress environments remain fully updated. Keeping plugins current and reviewing configuration settings, particularly custom upload storage locations and automatic login features, can significantly reduce the risk of exploitation by attackers seeking to compromise WordPress websites.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
