Security researchers have disclosed a critical vulnerability in the Forminator Forms plugin carrying a CVSS score of 9.8 – close to the maximum possible severity rating. The flaw lets an unauthenticated attacker upload an arbitrary executable file to the server, handing them full control of the site. Forminator is used on hundreds of thousands of websites worldwide for contact forms, polls, and payment gateways.
What’s actually broken
The vulnerability, tracked as CVE-2026-15748, comes down to insufficient file-type validation in the plugin’s upload fields. An attacker can bypass extension and MIME-type checks and drop a PHP script or other executable code straight into the site’s file structure – with no login required at any point. Once the file is on the server, a direct request is enough to execute it, giving the attacker full access to the database, files, and the rest of the hosting environment.
Why it’s such a big deal
Forminator-style forms are typically exposed publicly, with no login wall – which is exactly what makes them such an attractive target. Combine the plugin’s massive install base with how trivially the bug can be exploited (no user or admin interaction needed at all), and you get exactly the kind of flaw attackers start scanning for, automatically and at scale, within days of disclosure. We saw a similar pattern this summer with the wp2shell flaw in WordPress core itself.
What to do if you run the plugin
The priority is updating Forminator Forms to the latest patched version right away – the developers have already shipped a fix. If an immediate update isn’t possible, temporarily disable any forms with file-upload fields, or restrict execution at the server level (for example, blocking PHP execution inside the upload directory). It’s also worth checking hosting logs for suspicious uploads with unusual file extensions over the past few days.
The bigger picture: a year of WordPress patches
Forminator is just the latest in a long line of serious WordPress vulnerabilities this year – after a critical core flaw (WordPress 7.0.3, 12 fixes including a pre-auth XSS) and the actively exploited wp2shell bug, it’s clear that keeping core and every plugin updated is no longer just good practice – it’s a necessity. Automated scans for vulnerable sites now run around the clock, and the window between disclosure and mass exploitation keeps shrinking.
Conclusion
A critical hole in a plugin as widely used as Forminator is a reminder that website security isn’t a one-time task but an ongoing process – updates, monitoring, and regular audits. Not sure whether your site is up to date and secure? Reach out and we’ll take a look.
