600,000 WordPress Sites Run This Form Plugin. It Let Anyone Rewrite the Upload Rules Before Uploading. 300,000 Were Still Vulnerable at Disclosure.

[CVE-2026-15748](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-15748). CVSS 9.8. Forminator Forms, a WordPress form builder with more than 600,000 active installations, affected in every release up to and including 1.56.1. Unauthenticated arbitrary file upload leading to remote code execution — no login, no user interaction, no clicking anything.

SecurityWeek estimated that over 300,000 sites were still running vulnerable releases when it was publicly disclosed around August 17.

We are a week behind the disclosure on this one and we are not going to pretend otherwise. What we can add is who this actually lands on, and why the mechanism is worth understanding even if you never touch WordPress.

The mechanism: the plugin trusted its own configuration

The flaw lives in handle_file_upload, and the tracked description is the interesting part — arbitrary file upload via forged upload field configuration. Insufficient file type validation in that function lets an unauthenticated attacker upload executable files, including PHP, which the web server will then happily execute.

Sit with the phrase forged upload field configuration. A form builder's whole job is to let a site owner define fields: this one is an email, this one is a phone number, this one accepts uploads of these types up to this size. Those rules are the security control. And the plugin accepted the field configuration from the request rather than binding it to what the site owner actually defined server-side.

So the attacker does not defeat the file-type allowlist. The attacker supplies the allowlist. Then they upload a .php file that complies perfectly with the rules they just wrote, and the validation passes, because validation is doing exactly what it was told.

That is the same failure we have been describing all month in five other products: the control worked. It applied the rules it was given. Nobody drew a line saying which side of the request those rules come from.

Who actually runs this, which is the part that matters

600,000 active installations of a free form builder is not an enterprise number. Forminator is what you install when you need a contact form, a quote request, a booking enquiry or a simple poll, and you are not going to pay for one.

That is a dentist. A parish office. A small law practice. A regional charity. A one-person consultancy. A community group whose site was built five years ago by somebody's nephew who has since moved away. These are sites with no security team, no WAF, no monitoring, no patch window and frequently nobody who knows what a CVE is — and, critically, sites that collect exactly the data a form implies: names, emails, phone numbers, enquiry details, sometimes CVs or medical enquiries or financial details, all sitting in a WordPress database.

Unauthenticated RCE on that population is not a website defacement risk. It is a shared-hosting foothold, a mail-relay for phishing, a crypto-miner, and a database full of personal data belonging to people who never chose the plugin and have never heard of it.

300,000 still vulnerable at disclosure is the number that should be quoted, and it will not improve quickly, because auto-update is off on a large fraction of these installs and nobody is watching.

What to do, and how to help someone who cannot

If you run Forminator: update immediately to a release later than 1.56.1. Then, because unauthenticated RCE has been available since disclosure, go and look at your uploads directory for files that should not be there — anything with a .php, .phtml, .phar or double extension in the Forminator upload path or anywhere under wp-content/uploads. A recently-created PHP file in an uploads directory is not ambiguous.

Then close the class, not just the bug. Configure your web server to refuse to execute PHP anywhere under wp-content/uploads. It is a handful of lines in Apache or nginx, it costs nothing, and it neutralises this entire family of plugin upload flaws — including the next one, which is coming, because there is always a next one. If you do one thing from this post, do that one. It is worth more than the patch.

And if you have the skills, spend twenty minutes on somebody who does not. Practically everyone reading this knows a small organisation running WordPress with a contact form on it. Checking their plugin versions and turning off PHP execution in the uploads directory is a twenty-minute favour that removes a real, currently-exploitable path to a database of other people's personal information.

That is the whole reason we cover this tier. The vulnerabilities that get the most coverage are the ones affecting organisations that can already defend themselves. The ones that do the most damage per unit of attention are these — high install counts, zero defensive capacity, and personal data belonging to people with no say in the matter.

Capped where we always cap it at 95 percent: we have no first-party telemetry on exploitation of this CVE, the 300,000 figure is SecurityWeek's estimate at disclosure rather than a live count, and we were a week behind the disclosure. Credit for the finding is not ours.

Sources

CVE-2026-15748, CVSS 9.8, unauthenticated arbitrary file upload via forged upload field configuration in Forminator Forms handle_file_upload; affects all versions through 1.56.1. Reported by The Hacker News, SecurityWeek, SOC Prime, Rapid7 and securityonline.info, around 17 August 2026. Installation and still-vulnerable estimates as published at that date.

If you patch a small organisation's site off the back of this — or if you turn off PHP execution in an uploads directory for someone — tell me. That is the outcome this post exists for, and I would genuinely like to know it happened. Rate this post below.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=600-000-wordpress-sites-run-this-form-plugin-it-let-anyone-rewrite-the-upload-rules-before-uploadin