Sites running Forminator Forms, a WordPress plugin with over 600,000 active installs, can be fully taken over through a critical file upload bug that needs no authentication.
The flaw, CVE-2026-15748, carries a CVSS score of 9.8 and was reported by a researcher using the alias daroo. Wordfence says the problem lives in the handle_file_upload() function, where a dangerous-extension blocklist performs exact-key matching that a crafted pipe-alternative MIME type key can bypass.
Exploitation requires a form containing both a File Upload field and a Select field. In default configurations, files land in a directory protected by an .htaccess rule that blocks PHP execution, but sites with a custom file upload storage root skip that protection, so simply requesting the uploaded file triggers the attacker’s code.
All versions up to and including 1.56.1 are affected, and the vendor has shipped a fix in the plugin’s latest release. The same advisory window also covers CVE-2026-15826, a 9.8-rated authentication bypass in User Profile Builder that can let unauthenticated attackers log in as existing users on about 40,000 sites.
WordPress admins should update both plugins immediately, audit for unexpected files in upload directories, and consider disabling file upload fields on public forms until patched.
