Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "
Source: The Hacker News · August 17, 2026 at 7:52 PM · AI-assisted report
KUALA LUMPUR, 18 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
A critical flaw in the Forminator Forms plugin, used by more than 600,000 WordPress sites worldwide, has been disclosed as CVE‑2026‑15748. The vulnerability, rated 9.8 on the CVSS scale, allows unauthenticated attackers to upload arbitrary files, including PHP, and achieve remote code execution (RCE). The flaw was identified by security researcher “daroo” and reported to Wordfence, which issued a detailed advisory on 17 August 2026.
Market Impact
Forminator versions up to and including 1.56.1 are affected. The issue resides in the `handle_file_upload()` function, where insufficient file‑type validation permits an attacker to bypass the dangerous‑extension blocklist by using pipe‑separated MIME type keys. When a form contains both a File Upload field and a Select field, an attacker can submit a specially crafted PHP file.
If the site uses the default upload directory, an .htaccess file normally blocks PHP execution; however, sites that have configured a Custom File Upload Storage root may lack this safeguard, allowing the uploaded file to be executed on the server. The vulnerability was patched in Forminator 1.56.2, released on 31 July 2026.
The same day, Wordfence highlighted a separate authentication bypass in User Profile Builder (CVE‑2026‑15826, CVSS 9.8). This flaw permits unauthenticated users to log in as the site administrator (user ID 1) on sites where the plugin’s “Automatically Log In” setting is enabled. The bug stems from the `wppb_log_in_user()` function, which coerces a WordPress error object to the integer 1 before performing an error check, thereby binding an autologin nonce to the administrator account.
The issue was fixed in User Profile Builder 3.16.5 on 16 July 2026.
Impact on the Malaysian Market Malaysia hosts a growing number of WordPress‑based websites across e‑commerce, education, and government sectors. While the exact number of Malaysian sites using Forminator or User Profile Builder is not publicly disclosed, the global prevalence of these plugins suggests that a significant portion of local sites may be vulnerable. An RCE or administrative takeover could compromise sensitive data, disrupt services, and damage brand reputation.
Malaysian cyber‑security authorities have urged site owners to verify plugin versions and apply patches immediately.
Sector and Company Specifics The vulnerability does not target any specific industry; however, sectors that rely heavily on user‑generated content—such as online marketplaces, news portals, and community forums—are at higher risk. Companies that use Forminator for contact forms, surveys, or event registrations should review their form configurations, particularly the presence of File Upload and Select fields.
Similarly, any organization employing User Profile Builder for user registration or profile management must ensure the “Automatically Log In” feature is disabled or the plugin is updated.
Current Development and Response WordPress security teams have coordinated with plugin developers to release patches. Forminator’s 1.56.2 update includes stricter file‑type validation and enhanced .htaccess handling for custom upload directories. User Profile Builder’s 3.16.5 update removes the flawed authentication logic. Wordfence recommends that site administrators run a full security audit, check for outdated plugins, and monitor for suspicious upload activity.
The advisory also advises disabling file uploads on forms that do not require them and restricting MIME types to a whitelist.
Outlook With the rapid pace of vulnerability discovery in open‑source platforms, the Malaysian digital ecosystem must maintain vigilant patch management practices. The recent disclosures underscore the importance of timely updates and configuration hardening. While the immediate threat has been mitigated by the released patches, ongoing monitoring for new exploits remains essential. Malaysian businesses and government agencies should prioritize securing their WordPress installations, especially those handling sensitive user data, to safeguard against potential breaches.