Forminator – Contact Form, Payment Form & Custom Form Builder, CVE-2026-15748
- CVE, Research URL
- Home page URL
-
Security reports for Forminator – Contact Form, Payment Form & Custom Form Builder
- Published on
- Aug 18, 2026
- Research Description
- The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- Affected versions
-
max 1.56.2.
- Status
-
vulnerable