CVE-2026-15748 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-15748 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-15748 is a critical arbitrary file upload vulnerability in the Forminator Forms plugin for WordPress, affecting all versions through 1.56.1.

Technical Detail

The flaw exists in the plugin's handle_file_upload function, which insufficiently validates uploaded file types. An attacker can bypass the dangerous-extension blocklist by using pipe-alternative MIME type keys and can inject attacker-controlled upload-field configuration through a forged Select field value submitted to a public form handler. Successful exploitation may allow an unauthenticated attacker to upload malicious files; if uploaded files can be executed by the web server or otherwise processed unsafely, this can lead to remote code execution and full site compromise.

Exploitation Status

A proof of concept is available. CVE-2026-15748 is not listed in CISA's Known Exploited Vulnerabilities catalog as of August 18, 2026, and active exploitation in the wild has not been confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Treat this as an urgent patching priority. Upgrade Forminator Forms to a vendor-provided release that fixes CVE-2026-15748, and do not continue operating versions 1.56.1 or earlier where public form submission is enabled. Until patching is complete, disable or restrict public forms that accept uploads, review form configurations for unexpected upload fields or altered Select field values, and ensure the WordPress uploads directory does not permit script execution. Review web server, WordPress, and Forminator logs for unusual multipart form submissions, unexpected MIME type values containing pipe characters, forged Select values, and newly created executable or script files in upload-accessible directories. Remove suspicious uploaded files and investigate associated requests and account activity.