A critical vulnerability in Forminator Forms, a WordPress plugin installed on over 600,000 sites, enables unauthenticated attackers to execute arbitrary code on vulnerable servers.
CVE-2026-15748 carries a CVSS score of 9.8, placing it in the highest severity category. The flaw allows attackers to upload malicious PHP files without authentication, leading to remote code execution. An attacker exploiting this vulnerability gains full control over an affected WordPress installation, enabling data theft, malware deployment, site defacement, or lateral movement into connected networks.
Forminator Forms powers contact forms, surveys, and custom form functionality across hundreds of thousands of WordPress sites. The plugin's widespread deployment makes this vulnerability a high-priority target for threat actors. Organizations running unpatched versions face immediate risk.
The vulnerability stems from insufficient input validation in the plugin's file upload mechanism. Attackers craft requests that bypass security checks, allowing them to place executable PHP code directly on the server. Because the flaw requires no authentication, any internet user can attempt exploitation without valid credentials or account access.
WordPress administrators should immediately patch Forminator Forms to the latest available version. Check your WordPress dashboard under Plugins for pending updates. If updates are not yet available from the plugin developer, temporarily disable Forminator Forms until a patch releases. Monitor server logs for suspicious file upload activity or PHP execution in unexpected directories.
Security teams should review recent access logs for this plugin's upload functionality and scan web directories for suspicious PHP files. This attack leaves server traces. Organizations using Forminator Forms on public-facing sites face the highest risk. Those limiting plugin access through web application firewalls or restricting upload directories reduce their exposure while awaiting patches.
The plugin's developer should release patched versions immediately. Until then, disabling the plugin remains the safest option for organizations unable to accept the risk of a remotely