SYS::ONLINE
Wasteland.
Briefs2197
Issues24
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-15748 2026-08-18

CVE-2026-15748: Unauthenticated Arbitrary File Upload in WordPress Forminator Forms

"A critical (CVSS 9.8) arbitrary file upload flaw in the Forminator Forms plugin for WordPress lets unauthenticated attackers upload executable files, opening the door to remote code execution."

A critical (CVSS 9.8) arbitrary file upload flaw in the Forminator Forms plugin for WordPress lets unauthenticated attackers upload executable files, opening the door to remote code execution.

What Is It

CVE-2026-15748 is an arbitrary file upload vulnerability (CWE-434) in the Forminator Forms plugin for WordPress, reported by Wordfence and published on 2026-08-18. The flaw lives in the handle_file_upload function, which performs insufficient file type validation. Its dangerous-extension blocklist relies on exact-key matching, which can be bypassed using pipe-alternative MIME type keys. That weakness is compounded by a public submission handler that trusts attacker-controlled upload field configuration injected through a forged Select field value.

The result: an unauthenticated attacker can upload files that may be executable, making remote code execution possible.

Why It Matters

The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability dial is turned to the worst setting, network-reachable, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. The vulnerable code path sits behind a public submission handler, meaning any internet-facing site running an affected version exposes it to anonymous attackers.

There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the provided source material.

What's Vulnerable

Every vulnerable code path cited below is drawn from the 1.55.1 release tag in the WordPress Plugin Trac browser. The NVD record lists no CPE matches at this time; the vulnerability status is "Received," meaning analysis is still pending.

Patch Status

The supplied NVD record does not specify a fixed version or vendor patch, and no required remediation action is included in the source data. Administrators running Forminator Forms 1.55.1 or earlier should consult the Wordfence advisory and vendor listing for current update guidance.

Sources