A critical security weakness in Forminator Forms, a WordPress plugin with over 600,000 active installations, could let attackers execute arbitrary code on vulnerable websites. Security firm Wordfence disclosed the flaw today, identifying it as CVE-2026-15748 with a severity score of 9.8 out of 10.0. The vulnerability allows unauthenticated attackers to upload any file type to affected sites, potentially leading to complete site compromise.
The flaw impacts all versions of Forminator Forms through 1.56.1 and was patched in version 1.56.2 released on July 31, 2026. Successful exploitation requires that vulnerable sites have a form containing both a File Upload field and a Select field. A security researcher using the alias "daroo" discovered and reported the vulnerability. The weakness stems from an arbitrary file upload issue in the handle_file_upload() function, where inadequate file type validation allows attackers to bypass security checks by manipulating MIME type keys through forged Select field values.
According to Wordfence, "This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise." The security firm explained the flaw involves insufficient file type validation where a dangerous-extension blocklist performs exact-key matching that attackers can bypass using pipe-alternative MIME type keys. By default, files upload to a directory protected by an .htaccess file preventing PHP execution, but sites with a Custom File Upload Storage root configured may lack this safeguard—the protective file only generates when first needed during a frontend request where the WordPress helper responsible for writing it isn't loaded.
The vulnerability's exploitation path illustrates how modern content management systems can create unexpected attack surfaces when multiple features interact. Attackers can submit forms with specially crafted PHP files, and if the site administrator has customized file storage settings, simply requesting the uploaded file triggers the web server to execute malicious code. Wordfence also revealed a separate critical authentication bypass bug in User Profile Builder, a plugin with more than 40,000 active installations, tracked as CVE-2026-15826 with a 9.8 severity score. That flaw, patched July 16, 2026 in version 3.16.5, lets unauthenticated attackers log in as the administrator on sites where the Automatically Log In setting is enabled—the wppb_log_in_user() function calls absint() on wp_insert_user()'s return value before checking for errors, so when registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to integer 1 before the error check can halt execution, causing the plugin to return an autologin nonce tied to user ID 1.
Site owners running either plugin should apply updates immediately and verify their installations are current. The simultaneous disclosure of two critical WordPress plugin vulnerabilities with identical severity scores underscores the persistent challenge of securing third-party extensions that handle user input and authentication. Organizations relying heavily on plugin ecosystems face a structural dilemma between feature velocity and security review capacity, where convenience features like automatic login or custom file storage can introduce risk that default configurations intentionally avoid.