Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
- ID
- 14992
- Status
- summarized
- Published
- 18 Aug 2026, 2:22 AM
- Fetched
- 18 Aug 2026, 5:13 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.0
- Created
- 18 Aug 2026, 5:16 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
A CVSS 9.8 unauthenticated remote code execution flaw (CVE-2026-15748) in the Forminator Forms WordPress plugin affects all versions through 1.56.1, across 600,000+ active installations. Exploitation requires a form containing both a File Upload and Select field; the handle_file_upload() function's extension blocklist is bypassed via pipe-alternative MIME type keys, and custom storage roots may lack the .htaccess PHP-execution guard present in the default upload directory. The fix shipped in version 1.56.2 on July 31, 2026.
Why it matters
If you or your clients run WordPress sites with Forminator Forms at or below 1.56.1 and use forms combining File Upload with Select fields, update to 1.56.2 immediately and audit whether any custom File Upload Storage root is missing an .htaccess file blocking PHP execution. WordPress remains ubiquitous among Malaysian SMEs and agency-built sites, so this is a concrete patch-or-get-compromised situation rather than a theoretical risk.
Discussion angle
Walk through the specific bypass mechanism—pipe-alternative MIME type keys defeating an exact-match blocklist—and discuss why relying on blocklists instead of allowlists for file validation remains a recurring pattern in PHP plugin vulnerabilities.