Forminator Forms Plugin Vulnerability: Critical Arbitrary File Upload
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- forminator (wordpress)
- Patched version
- Not yet available
The Forminator Forms plugin for WordPress is reportedly vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1. This vulnerability may allow unauthenticated attackers to upload executable files, enabling remote code execution.
What happened
The vulnerability, tracked as CVE-2026-15748, is due to insufficient file type validation in the handle_file_upload function. This allows attackers to bypass the dangerous-extension blocklist by using pipe-alternative MIME type keys. Combined with a public submission handler that trusts attacker-controlled upload field configuration, this makes it possible for unauthenticated attackers to upload files that may be executable.
According to primary sources, this issue affects all versions of the Forminator Forms plugin up to and including 1.56.1. It is critical for users of this plugin to assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Upgrade the Forminator Forms plugin to a version beyond 1.56.1.
- Review all uploaded files for any suspicious activity.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Consider implementing additional security measures to protect against similar vulnerabilities.
How 0Day would have caught this
forminator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Forminator Forms plugin for WordPress in versions up to and including 1.56.1, you are potentially affected.
What should I do right now?
Immediately upgrade the Forminator Forms plugin to a version beyond 1.56.1 and review all uploaded files for suspicious activity.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.