Forminator WordPress Plugin Unauthenticated RCE via Malicious PHP Upload

Technical Analysis

CVE-2026-15748 carries a CVSS score of 9.8, indicating unauthenticated, low-complexity exploitation with high impact on confidentiality, integrity, and availability. The vulnerability stems from insufficient validation of file upload functionality within Forminator Forms, allowing attackers to upload arbitrary PHP files that can be executed on the server, resulting in full remote code execution. Exploitation likely involves crafting form submissions that bypass file-type restrictions to plant a webshell or backdoor in the WordPress uploads directory. If successful, attackers gain persistent access to the underlying hosting environment, enabling lateral movement, data exfiltration, or malware deployment. Organizations running AI agents or RAG pipelines on WordPress-hosted infrastructure (e.g., using WordPress as a content source, chatbot backend, or API gateway) could see agent credentials, API keys, or database connection strings exposed if the compromised host also serves agent-facing services.

Affected Systems

WordPress sites running Forminator Forms plugin versions vulnerable to unauthenticated arbitrary file upload (specific patched version not stated in source; users should consult the official plugin changelog for the fixed release). Affects any WordPress installation with the plugin active, regardless of user roles or authentication settings for form submission.

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) provided in source reporting at time of disclosure.

Remediation Steps

1. 1

   Update Forminator Forms Plugin

   Immediately update to the latest patched version of Forminator Forms as released by the vendor (WPMU DEV).

2. 2

   Audit Upload Directories

   Scan wp-content/uploads and plugin-specific upload paths for unauthorized PHP files or webshells.

3. 3

   Restrict File Upload Types

   Apply web server or WAF rules to block execution of PHP files within upload directories.

4. 4

   Enable WAF Protection

   Deploy a Web Application Firewall with rules covering this CVE to block exploitation attempts until patching is complete.

5. 5

   Review Site Logs

   Check access and error logs for suspicious form submissions or unexpected file uploads around the disclosure timeframe.

6. 6

   Rotate Credentials

   If compromise is suspected, rotate all WordPress admin, database, and any integrated API credentials, including those used by connected AI agent or automation systems.