# 600,000 WordPress Websites At Risk RCE: How Dangerous Is Forminator Vulnerability?

## Overview

Imagine a seemingly impossible scenario: A completely unknown attacker with no admin account, no need to log in, and no need to trick anyone into clicking on a malicious link. With just a single HTTP Request sent to the contact form on your website, that person quietly turned a malicious PHP file into a valid file, put it straight into the server drive and immediately took full control of the system (RCE).

It is worth mentioning that the fulcrum for this attack lies in the most innocent component: the Select field - where users often click to select "Department to contact" or "Service type".

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/959e52ea-0e7e-4a81-a386-f04ee512c311.png align="center")

How can a normal picklist field be "transformed" into a fake configuration array, forcing the system to believe it is a trusted Upload field? And why can a simple pair of parentheses like ph(p) completely defeat WordPress' dangerous blacklist filter?

The vulnerability coded CVE-2026-15748 with a perfect score of CVSS 9.8 (Critical) is the answer to this series of sophisticated logic loopholes. With over 600,000 WordPress sites using the Forminator Forms plugin (of which an estimated 300,000+ contain dangerous forms), this is one of the most notable RCE vulnerabilities of 2026.

If you want to know:

*   How did an attacker trick Forminator's PHP source code processing flow using Carrier Field Injection?
    
*   Actual request structure and how to build a local Lab environment to manually verify the operating principle?
    
*   Server Hardening defense steps to block all automatic scans from botnet networks?
    

Let's dive into the detailed technical analysis below.

## Overview of Forminator Forms

To understand why this vulnerability has such a large-scale impact, we first need to understand the nature and position of Forminator Forms in the WordPress ecosystem.

Forminator Forms is a comprehensive form plugin developed by WPMU DEV - one of the oldest and most reputable software developers for WordPress. This plugin currently reaches the milestone of more than 600,000 active installations (Active Installations) on the official WordPress.org page and is constantly in the Top choices for webmasters.

### Core features that make Forminator popular:

1.  Intuitive Drag-and-Drop Form Builder: Allows users to create from simple contact forms (Contact Form) to complex consulting registration forms without writing a single line of code.
    
2.  File Upload feature: Supports users to send attachments (such as CVs, incident images, design documents, invoices...) directly via the form. This feature handles both single file uploads (Single Upload) and multiple files (Multi-file Upload).
    
3.  Interactive Quizzes & Polls: Provides tools to create scoring quizzes and audience polls built into the plugin.
    
4.  Dynamic Calculations & Payment Integration (Calculations & Payments): Supports real-time formula calculations and built-in integration with online payment gateways such as Stripe and PayPal.
    
5.  Rich ecological connections: Easily synchronize user-sent data with CRM and Email Marketing platforms such as HubSpot, Mailchimp, Zapier, Google Sheets or Slack.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/6c2df1e2-1124-45c7-b22a-a5fb50c9119a.png align="center")

### Why has Forminator become an attractive target for Hackers?

Due to the nature of being a plugin serving user interaction, forms created by Forminator are required to be publicly published (Public-facing) on ​​the website interface. Anyone who visits the website can submit data to the form processing endpoint without performing authentication.

When the File Upload feature is combined with a large installation scale, Forminator becomes a "gold mine" for attackers. By simply detecting a loophole in the upload file processing and authentication flow, an attacker can turn a regular form management plugin into a backdoor to gain access to the web server system.

## Technical Background

Below are the official specifications of the vulnerability as documented by NVD and Wordfence Intelligence:A

| **Specification** | **Technical Details** |
| --- | --- |
| **Vulnerability ID** | CVE-2026-15748 |
| **CVSS v3.1 Base Score** | 9.8 (Critical) |
| **CVSS Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **Weakness Classification (CWE)** | **CWE-434:** Unrestricted Upload of File with Dangerous Type |
| **Affected Product** | Forminator Forms – Contact Form, Payment Form & Custom Form Builder |
| **Affected Versions** | All versions **≤ 1.56.1** |
| **Fixed Version** | **1.56.2** (Released on 31/07/2026) |
| **Discovered By** | **daroo** (Reported through Wordfence Bug Bounty Program – **$2,048 reward**) |

## Root Cause Analysis & Extraction Mechanism

The vulnerability CVE-2026-15748 is caused by a combination of three logical loopholes in Forminator's form processing source code.

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f55bab50-b628-4fa8-904a-ac8f0dd655d0.png align="center")

### Link 1: Carrier Field Injection via Select field

In the Forminator\_CForm\_Front\_Action class, the set\_field\_data() function is responsible for preparing the data submitted from the form. When processing select list fields (select-, radio-, checkbox-\*), Forminator's sanitization filter intentionally keeps the nested array intact to serve the next separate processing steps.

Attackers use the Select field as a "carrier field". By inserting the return attribute into the request array of the Select field, the processing function immediately bypasses the validation step and pushes the data array manipulated by the attacker directly into the internal storage array field\_data\_array:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f89267d4-2e0b-4592-a155-476bea372bee.png align="center")

### Link 2: Trusted Upload Configuration Override

After the input data is gathered, the process\_uploads() function of the Forminator\_Upload class proceeds to browse each element in field\_data\_array. This function just checks whether the field\_type attribute is equal to 'upload' or not. If satisfied, it fully trusts the included field\_array and uses it as the file loading configuration array:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f221b4ea-ff6c-4747-b3a6-ede66185cdce.png align="center")

By controlling $field\_settings, the attacker enables the custom format option (custom-files = true) and forces the system to accept the extended formats he specifies via the additional-type attribute.

**Link 3: Exact-Match Blocklist Bypass with ph(p)**

To prevent uploading dangerous files, Forminator calls the forminator\_allowed\_mime\_types() function to browse and remove executable file formats from the allowed list:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/fa84e9b5-7fdf-49f9-8373-922f39a2a1ed.png align="center")

The structure in\_array($key, $filters, true) performs exact string comparison. When the attacker sends the format as the expression ph(p)|text/x-php, the $key variable carries the value 'ph(p)'. Because 'ph(p)' !== 'php', the unset() statement is ignored, allowing the ph(p) extension to bypass the safety filter.

Immediately after, the WordPress file check function wp\_check\_filetype() is called. WordPress's extension mapping engine parses ph(p) into a valid regular expression (regex) that matches the .php extension. The malicious PHP file is accepted and written directly to the web server's public directory.

## Building a Test Lab & Analyzing Technical Nature

### Step 1: Prepare the Lab environment

Launch the WordPress environment:

*   WordPress Core: 6.5.x or 6.6.x
    
*   PHP: 8.1 (runs on Nginx or Apache)
    

Installing Forminator Forms error:

*   Download the Forminator Forms plugin zip file version 1.55.1 or 1.56.1
    
*   Activate the plugin in the WordPress admin interface.
    

### Step 2: Configure the Error Form

*   Go to Forminator $\\rightarrow$ Forms $\\rightarrow$ Create.
    
*   Select the Blank Form template and add 2 data fields:
    
    *   File Upload (default attribute name: upload-1)
        
    *   Select (default property name: select-1)
        
*   Click Publish and insert the form shortcode into a public website (eg Form ID is 100).
    

### Step 3: Detailed Request Payload structure

Use cURL or Burp Suite to send an HTTP POST Request to the AJAX processing endpoint (/wp-admin/admin-ajax.php):

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/d17293df-2823-450c-82b5-de1c1352e485.png align="center")

### Analyze the meaning of Payload fields:

*   select-1\[return\]=1: Triggers the condition !empty($field\_data\['return'\]), forcing the function to push the fake configuration into the field\_data\_array array.
    
*   select-1\[field\_type\]=upload: Fools the process\_uploads() function into thinking that the injected array is the Upload field configuration.
    
*   select-1\[name\]=upload-1: Specifies the actual input file field name that will receive the attachment.
    
*   select-1\[field\_array\]\[additional-type\]=ph(p)|text/x-php: Force the system to load the ph(p) extension rule to pass the filters array.
    

### Step 4: Verify the execution results

Forminator processes the file and saves it under a random filename (e.g. b7e9f1a2c3d4-webshell.php) in the /wp-content/uploads/forminator/100\_.../ directory.

Send HTTP GET Request to remotely activate the script:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/8f6ca460-f102-4a69-aa94-f7e937bbd2e5.png align="center")

## Actual Exploitation Record & Publication Timeline

Although there have been no documented targeted APT attack campaigns using this vulnerability, the risk to public WordPress systems is great because the technical details have been fully disclosed. Botnets often automatically scan the entire internet IP range to detect unpatched Forminator forms and install Web Shells en masse.

### Timeline to release information:

*   July 14, 2026: Researcher "daroo" discovered & reported via Bug Bounty
    
*   July 14, 2026: Wordfence verifies and transfers the report to WPMU DEV
    
*   July 20, 2026: WPMU DEV confirmed the error and started building a patch
    
*   July 31, 2026: WPMU DEV releases official patch version 1.56.2
    
*   August 17, 2026: Wordfence releases a public technical report
    

## MITRE ATT&CK Mapping

| **Tactic** | **Technique ID** | **Technique Name** | **Description in the CVE-2026-15748 Scenario** |
| --- | --- | --- | --- |
| **Initial Access** | `T1190` | Exploit Public-Facing Application | Exploiting a validation flaw in the `handle_file_upload` function through a publicly accessible form interface. |
| **Execution** | `T1059.004` | Command and Scripting Interpreter: Unix Shell | Executing malicious PHP code uploaded to the web server to run system commands. |
| **Persistence / Defense Evasion** | `T1505.003` | Server Software Component: Web Shell | Placing a PHP backdoor in the uploads directory to maintain long-term access. |

## Detection & Response

### Monitor Log Web Server

Check for HTTP POST requests sent to the admin-ajax.php endpoint or Forminator form processing routes that contain unusual parameter configuration in the request body:

*   grep -E "forminator\_submit\_form|forminator\_upload" /var/log/nginx/access.log | grep "POST"
    
*   find /var/www/html/wp-content/uploads/ -type f -name "\*.php" -ls
    

### SIEM / WAF Detection Query Concept Template

For WAF or SIEM systems (Elastic / Splunk / QRadar):

`request_method: "POST"`

`AND request_uri: "admin-ajax.php"`

`AND body_content: "forminator"`

`AND body_content: ".php"`

## Expert Comments

The Arbitrary File Upload vulnerability in the WordPress environment is not a new type of problem but always brings the most serious damage. With CVSS 9.8, CVE-2026-15748 allows a regular contact form to be turned into a portal that takes over the entire server without requiring any login information.

In the Vietnamese market, the WordPress content management system accounts for a very large proportion of small and medium-sized businesses (SMBs), press agencies, news sites as well as marketing department landing page campaigns. Actual SOC operations show that many units often have the habit of installing plugins and letting the system run for a long time without setting up a periodic testing and patching process (Patch Management).

When an RCE vulnerability of this type is publicly disclosed, botnets only take a few hours to scan the entire Vietnamese IP range and automatically drop the Web Shell. Therefore, relying entirely on the plugin's default filters is not enough; Businesses need to apply defense-in-depth layers.

## Recommended Action

To protect websites against the risk of being exploited through the vulnerability CVE-2026-15748, individuals and organizations operating WordPress need to quickly deploy the corrective measures detailed below:

### For Website Administrators (Site Admin / General Users)

1.  Update plugins immediately:
    
    *   Access the WordPress admin interface → Plugins → Installed Plugins.
        
    *   Find the Forminator Forms plugin and click Update Now to upgrade to version 1.56.2 (or later).
        
    *   Recommendation: Enable the Enable auto-updates feature for this plugin so that the system automatically receives future security patches.
        
2.  Review and delete unused forms:
    
    *   Delete trial forms, draft forms, or old forms that no longer work to narrow the attack surface.
        
3.  Scan the entire website for malware:
    
    *   Use reputable security plugins on WordPress (such as Wordfence Security, iThemes Security, Sucuri) to scan the entire file system, especially the wp-content/uploads/ directory, to early detect Web Shells or suspicious files that have been uploaded before the patch update.
        

### For Technical Administrators & IT Teams (SysAdmin / DevOps)

Disable permission to execute PHP scripts in the Uploads folder:

*   This is the most important defense-in-depth layer. Even if an attacker bypasses the plugin to upload a .php file to the uploads/ directory, the Web Server will still refuse to execute that file.
    

Sample configuration for Nginx:

`location ~* ^/wp-content/uploads/.*.php$ {`

`deny all; access_log off;`

`log_not_found off;`

`}`

Sample configuration for Apache (Create .htaccess file located in wp-content/uploads/ directory):

`<Files *.php>`

`Order Deny,Allow`

`Deny from all`

`</Files>`

Check the server log (Log Audit):

*   Scan the Web Server's Access Log to trace unusual HTTP POST requests directed to the admin-ajax.php endpoint containing the Forminator parameter, as well as HTTP GET accesses to newly created .php files in the uploads/ directory.
    

## References

[NVD - CVE-2026-15748](https://nvd.nist.gov/vuln/detail/CVE-2026-15748)

[600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin](https://www.wordfence.com/blog/2026/08/600000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/)

[Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads](https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html)

[300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw - SecurityWeek](https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/)