CVE-2026-15748 in Forminator Forms Plugin
Summary
by MITRE • 08/18/2026
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The Forminator Forms plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.56.1. This flaw is classified as an Arbitrary File Upload vulnerability, specifically located within the handle_file_upload function of the application's core logic. The root cause lies in insufficient file type validation mechanisms that fail to adequately restrict the types of files users can upload through form submissions. Because this functionality is exposed via a public submission handler, it does not require any authentication or user privileges, allowing unauthenticated attackers to exploit the flaw remotely over the network without prior access credentials.
The technical mechanism behind this vulnerability involves two distinct but complementary weaknesses in the input validation process. First, the plugin employs a blocklist of dangerous file extensions to prevent malicious uploads. However, this blocklist relies on exact-key matching for MIME type verification. Attackers can bypass these restrictions by utilizing pipe-alternative MIME type keys, which are not explicitly checked against the deny list due to the rigid nature of the comparison logic. This allows files with executable characteristics to pass through the initial validation stage undetected because their reported content types do not match the exact strings defined in the security blocklist.
Secondly, the vulnerability is exacerbated by how the plugin handles configuration data submitted via forms. The public submission handler trusts attacker-controlled upload field configurations that are injected through forged Select field values. By manipulating these form fields during the submission process, an attacker can dictate parameters related to file handling and storage locations. This lack of server-side validation on the structural integrity of the uploaded content metadata enables the successful placement of malicious files onto the web server's filesystem in a location where they may be executed by the underlying web service or interpreted by other system components.
The operational impact of this vulnerability is severe, as it directly facilitates Remote Code Execution (RCE). Once an attacker successfully uploads a script file such as PHP, Python, or another executable format to a publicly accessible directory within the WordPress installation, they can invoke that file via HTTP requests. This grants the attacker full control over the server environment running under the context of the web service user. Depending on the host's configuration and privileges, this could lead to complete compromise of the website data, lateral movement into internal networks, or use as a pivot point for further attacks against other systems connected to the compromised infrastructure.
From an industry standards perspective, this vulnerability aligns with CWE-434, which describes Unrestricted Upload of File with Dangerous Type, and CWE-20, Improper Input Validation. The exploitation technique also maps to MITRE ATT&CK techniques related to Initial Access via Web Applications and Execution via Command Line Interface or Scripting Interpreters, specifically leveraging the ability to upload and subsequently execute arbitrary code on a target system. These mappings highlight the severity of bypassing input validation controls in web application frameworks that handle user-generated content.
To mitigate this risk, administrators must immediately update the Forminator Forms plugin to version 1.56.2 or later, where these validation flaws have been addressed by implementing stricter MIME type verification and sanitizing upload field configurations regardless of client-side inputs. In addition to patching, organizations should implement Web Application Firewall rules that detect anomalous file uploads with suspicious content types or extensions commonly associated with web shells. It is also advisable to restrict the directories in which uploaded files can be stored, ensuring they are placed outside executable paths and have execute permissions disabled at the operating system level. Regular auditing of plugin code for similar validation weaknesses across other installed WordPress plugins is recommended to maintain a robust security posture against arbitrary file upload attacks.