300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
Critical vulnerability (CVE-2026-15748, CVSS 9.8) in Forminator Forms plugin allows unauthenticated remote code execution via arbitrary file upload The flaw stems from insufficient file type validation in handle_file_upload, where a dangerous-extension blocklist can be bypassed using pipe-alternative MIME type keys Attackers can forge Select field records to inject attacker-controlled upload field configuration, gaining full control over the upload process Over 300,000 websites are potentially e
Analysis
TL;DR
- Critical vulnerability (CVE-2026-15748, CVSS 9.8) in Forminator Forms plugin allows unauthenticated remote code execution via arbitrary file upload
- The flaw stems from insufficient file type validation in handle_file_upload, where a dangerous-extension blocklist can be bypassed using pipe-alternative MIME type keys
- Attackers can forge Select field records to inject attacker-controlled upload field configuration, gaining full control over the upload process
- Over 300,000 websites are potentially exposed out of 600,000+ installations, with half running vulnerable versions (up to 1.56.1)
- Patched in version 1.56.2 released July 31; no in-the-wild exploitation reported as of now
Why It Matters
This vulnerability highlights how seemingly minor input validation flaws in widely-used WordPress plugins can cascade into critical remote code execution risks, affecting hundreds of thousands of websites. It serves as a stark reminder for AI practitioners and security professionals that third-party plugin dependencies in any web application ecosystem require rigorous security auditing, especially for file handling functions.
Technical Details
- Vulnerability Type: Arbitrary file upload leading to Remote Code Execution (RCE), tracked as CVE-2026-15748 with a CVSS score of 9.8
- Root Cause: The handle_file_upload function performs exact-key matching on its dangerous-extension blocklist, which can be bypassed by using pipe-alternative MIME type keys (e.g., multipart/form-data variations)
- Attack Chain: Attackers forge form records using the Select field to take control of the field configuration passed to the upload function, then exploit the public submission handler that trusts attacker-controlled upload field configuration
- Exploitation Condition: In default configurations, uploaded files land in a protected directory preventing PHP execution; however, if a Custom File Upload Storage root is configured, this protection is not applied, enabling direct PHP code execution when the uploaded file is accessed
- Affected Versions: All Forminator Forms versions up to and including 1.56.1; patched in version 1.56.2 released July 31
Industry Insight
- WordPress plugin security remains a critical attack surface; developers and site administrators should prioritize updating Forminator to version 1.56.2 immediately and audit any custom file upload storage configurations for additional hardening
- The pipe-alternative MIME type bypass technique demonstrates the importance of implementing allowlist-based validation rather than relying solely on blocklists for file type restrictions across all web applications
- With over 300,000 potentially vulnerable installations and no current in-the-wild exploitation, this represents a window of opportunity for proactive defense; security teams should monitor for emerging exploit tools and consider implementing Web Application Firewall (WAF) rules to detect forged Select field payloads targeting the upload handler
Disclaimer: The above content is generated by AI and is for reference only.