External risk intelligence

Forminator Forms Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15748

The vulnerability exists in a WordPress contact form plugin designed specifically for public-facing web interaction. As an unauthenticated file upload mechanism used in web forms, the vulnerable endpoint is intended to be accessible to any visitor on the public internet.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Forminator Forms plugin for WordPress, allowing unauthenticated attackers to upload and execute arbitrary files. This could potentially lead to remote code execution on affected systems. The primary concern is to confirm if this plugin is in use and if so, to understand the exposure.

Flaw lets anyone upload malicious files.
Protects against remote system takeover.
Confirm plugin use and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can reach a vulnerable file upload feature in the Forminator Forms plugin by submitting a specially crafted form. This feature, which is publicly accessible, incorrectly validates file types, allowing attackers to upload executable files. Successful exploitation can lead to the execution of arbitrary code on the server.

No authentication required.
Upload files through a form.
Risk of code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows unauthenticated attackers to upload executable files to a WordPress site. When supported by the advisory, this could lead to remote code execution, potentially impacting the integrity and availability of the affected site.

Website files and server access.
Unauthenticated file upload.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Forminator Forms plugin's file upload vulnerability, accessible by unauthenticated attackers, likely falls under the purview of application owners and web platform teams. The first practical move is to identify all instances of the Forminator plugin across your WordPress deployments, confirm if these forms are publicly accessible, and then determine the business criticality of each instance to prioritize remediation efforts.

Application owners should prioritize remediation.
Verify public reachability and business impact.
Coordinate vendor updates and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Forminator Forms plugin for WordPress?

Forminator is a popular tool used to create interactive content like contact forms, polls, quizzes, and payment fields on WordPress sites. It allows site administrators to collect data directly from their web pages and manage file uploads from users, making it a common component for businesses that need to accept documents or images from visitors.

How does CVE-2026-15748 work?

This vulnerability is an Unrestricted Upload of File with Dangerous Type, classified as CWE-434. The plugin fails to properly check file extensions when a user uploads content. Because the security filter uses a limited list of forbidden file types, an attacker can use a specially formatted request to trick the system into accepting executable files, which can then be run on the server.

When can an attacker trigger this file upload flaw?

An attacker triggers this by interacting with a web form that utilizes the plugin's upload field. Because the vulnerability relies on manipulating how the plugin processes form submissions, it does not require the attacker to have an account or administrative privileges. Simply interacting with the form configuration is enough, provided the form is active.

Do I need to worry if my site uses Forminator?

Yes, if you use this plugin, you should investigate your setup. According to Halo Surface Signal, this vulnerability is critical because the plugin is designed for public interaction, meaning the vulnerable endpoint is almost certainly exposed to the internet. Any instance of the plugin on a public-facing website is potentially reachable by remote actors.

What is the first step to address this issue?

Begin by creating an inventory of all WordPress sites in your environment to identify where Forminator is installed. Once you locate the affected sites, confirm if they use the file upload feature and assess the importance of those forms to your operations. This will help you prioritize which websites require immediate updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.