“This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise,” Wordfence warned in a report published today.
CVE-2026-15748: how handle_file_upload permits unauthenticated PHP uploads
A critical arbitrary-file-upload flaw in the Forminator Forms WordPress plugin can let unauthenticated actors achieve remote code execution on vulnerable sites. Tracked as CVE-2026-15748 and given a CVSS score of 9.8, the vulnerability was discovered by a researcher using the alias “daroo” and analyzed by Wordfence.
According to Wordfence, the bug lives in the plugin’s handle_file_upload() function and stems from insufficient file type validation in user-supplied input. The dangerous-extension blocklist performs exact-key matching that can be bypassed by “pipe-alternative MIME type keys,” and a public submission handler trusts upload-field configuration that an attacker can inject via a forged Select field value. Those two conditions together enable an attacker to submit a form that stores arbitrary files — including specially crafted PHP files — on a site.
Scope, prerequisites, and the patch timeline for Forminator
Forminator Forms has more than 600,000 active installations; the flaw affects all versions of the plugin before and including 1.56.1. The maintainers released a fix in version 1.56.2 on July 31, 2026. Wordfence’s advisory emphasizes that a successful exploit requires a form on the site that includes both a File Upload field and a Select field, so not every installation is equally exposed.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy Custom File Upload Storage increases the danger
Out of the box, Forminator uploads files into a directory protected by an .htaccess file that prevents PHP execution. Wordfence cautions, however, that sites configured to use a Custom File Upload Storage root may lose that protection. The .htaccess file for a custom root is created “only when it is first needed, during a frontend request where the WordPress helper responsible for writing the .htaccess file is not loaded.”
That timing means an attacker who can upload a PHP file to a custom storage root may be able to request the file directly and cause the web server to execute the attacker-controlled PHP code, resulting in complete site compromise.
CVE-2026-15826: a second critical flaw in User Profile Builder patched earlier in July
Wordfence published another high-severity advisory days earlier about an authentication-bypass bug in the User Profile Builder plugin (more than 40,000 active installations). Tracked as CVE-2026-15826 and also scored 9.8, that vulnerability could allow unauthenticated attackers to log in as the user with ID 1 — typically the site administrator — and take over an affected site.
Wordfence explained the issue stems from wppb_log_in_user() calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object; absint() coerces that object to the integer 1 before the error check can short-circuit execution, which allows the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. The flaw was patched in version 3.16.5 on July 16, 2026, and is only exploitable where the plugin’s Automatically Log In setting is enabled.
What Forminator site owners, administrators, and attackers should do or watch for
- Forminator site owners: update the plugin to version 1.56.2 (released July 31, 2026) immediately if your installation uses File Upload and Select fields.
- Administrators using Custom File Upload Storage: verify that the custom storage root has the same .htaccess protections as the default upload directory and confirm those protections are being created as expected during frontend requests.
- Site administrators running User Profile Builder: ensure you are on version 3.16.5 or later (patched July 16, 2026), and review whether the Automatically Log In setting is enabled; the vulnerability is only exploitable when that setting is active.
- Adversaries and threat analysts: the two bugs carry the same 9.8 CVSS rating and affect widely installed plugins; exploitability depends on specific plugin settings (File Upload + Select fields for Forminator, and Automatically Log In enabled for User Profile Builder).
Two high-severity, high-impact vulnerabilities affecting widely used WordPress plugins were patched in July 2026. The concrete steps are straightforward and stated in the advisories: apply Forminator 1.56.2 and User Profile Builder 3.16.5, and double-check custom upload storage and automatic-login settings where they apply. The technical detail in Wordfence’s write-ups — from handle_file_upload’s blocklist logic to the absint() coercion — provides clear fingerprints for incident response teams to hunt for related misuse on sites that have not yet been updated.
