Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks
Brief
A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files , potentially enabling them to take full control of vulnerable websites.
The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.
- 1 and earlier and carries a CVSS severity score of 9.
- Forminator Forms is a widely used drag-and-drop plugin for building contact, payment, poll, quiz, and file-upload forms. With more than 600,000 active installations, the vulnerability poses a significant risk to WordPress administrators who have not yet applied the available update.
WordPress Plugin Vulnerability
The flaw was reported through the Wordfence bug bounty program by security researcher daroo, who received a $2,048 reward for the discovery.