A critical security flaw in Forminator Forms for WordPress, used by over 600,000 sites, allows unauthenticated attackers to upload arbitrary files, including PHP, leading to remote code execution and potential site takeover (CVE-2026-15748, severity 9.8/10).

The vulnerability stems from insufficient file-type validation and a bypassable dangerous-file extension blocklist, enabling executable uploads via manipulated MIME types and a forged form submission.

Affected versions run up to 1.56.1; a patch released as version 1.56.2 on July 31, 2026, mitigates the flaw by enforcing stricter file validation and secure handling of uploads.

Defiant notes that, as with similar arbitrary file upload flaws, successful exploitation could grant attackers full site compromise through webshells and other techniques.

With more than 600,000 installations, and estimates that a substantial subset are running vulnerable versions, the potential impact is broad, affecting hundreds of thousands of sites.

Exploitation requires a form containing both a File Upload field and a Select field; all versions up to 1.56.1 are affected, and the patch 1.56.2 arrived on the scene at the end of July 2026.

Site owners are advised to update Forminator Forms to 1.56.2+ and Royal Elementor Addons to the latest safe version to mitigate the risk.

Royal Elementor Addons version 1.7.1066 already contains fixes for these issues; admins should verify and apply the update if needed.

In default setups, uploads go to a protected directory that blocks PHP execution, but certain Custom File Upload Storage configurations can bypass this protection, increasing risk of code execution.

The root cause combines weaknesses: forged Select field records, configurable upload fields controlled by attackers, and bypasses around the plugin’s file-type restrictions.

Wordfence and other security advisories warn about these vulnerabilities and provide remediation steps for affected sites.

Users and site administrators should promptly update both Forminator Forms and User Profile Builder to the latest versions to mitigate risks, as a related authentication bypass vulnerability (unrelated to Forminator) was reported in User Profile Builder.