Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
CVE-2026-15748: Critical unauthenticated RCE in Forminator WordPress plugin (CVSS 9.8) via arbitrary PHP file upload due to insufficient file type validation in `handle_file_upload()` CVE-2026-15826: Critical authentication bypass in User Profile Builder plugin (CVSS 9.8) allowing unauthenticated login as admin (user ID 1) via integer coercion of WP_Error object Both vulnerabilities were patched in July 2026; Forminator update released July 31 (v1.56.2), User Profile Builder patched July 16 (v3.
Analysis
TL;DR
- CVE-2026-15748: Critical unauthenticated RCE in Forminator WordPress plugin (CVSS 9.8) via arbitrary PHP file upload due to insufficient file type validation in
handle_file_upload() - CVE-2026-15826: Critical authentication bypass in User Profile Builder plugin (CVSS 9.8) allowing unauthenticated login as admin (user ID 1) via integer coercion of WP_Error object
- Both vulnerabilities were patched in July 2026; Forminator update released July 31 (v1.56.2), User Profile Builder patched July 16 (v3.16.5)
- Exploitation of Forminator requires a form containing both a File Upload field and a Select field; User Profile Builder exploit requires "Automatically Log In" setting enabled
- Together these flaws affect over 640,000 WordPress installations and enable complete site compromise without any authentication
Why It Matters
These vulnerabilities demonstrate how seemingly minor input validation and type-coercion flaws in widely deployed WordPress plugins can lead to catastrophic unauthenticated remote code execution and full administrative takeover. For AI practitioners and security professionals, they underscore the critical importance of supply-chain security and the need to keep all third-party dependencies patched, as compromised plugins remain one of the most common attack vectors against web applications.
Technical Details
- CVE-2026-15748 (Forminator): The
handle_file_upload()function uses a dangerous-extension blocklist that performs exact-key matching, which is bypassed by pipe-alternative MIME type keys. A forged Select field value injects attacker-controlled upload field configuration into a public submission handler, allowing arbitrary PHP file uploads. Default uploads are protected by.htaccess, but custom upload storage directories may lack this safeguard because the directory is created on first frontend request before the WordPress.htaccesshelper loads. - CVE-2026-15826 (User Profile Builder): The
wppb_log_in_user()function callsabsint()on the return value ofwp_insert_user()before performing anis_wp_error()check. When a registration form submits a username of 61–70 characters, WordPress core returns aWP_Errorobject, butabsint()coerces it to integer1(the admin user ID) before the error check can short-circuit, causing the plugin to issue a transient-backed autologin nonce for the administrator account. - Both vulnerabilities carry a CVSS score of 9.8 (Critical) and require no authentication for exploitation.
- Forminator has 600,000+ active installations; User Profile Builder has 40,000+ active installations.
Industry Insight
- WordPress plugin ecosystems remain a high-value attack surface; security audits should prioritize plugins with file upload and authentication-handling functionality, especially those with large install bases.
- The pipe-alternative MIME type bypass and integer coercion of
WP_Errorobjects highlight the need for defense-in-depth: strict allowlist-based file type validation and proper error-object handling before any type coercion in plugin code. - Site operators should implement automated patch management for WordPress plugins and consider Web Application Firewalls (WAFs) that can detect and block exploitation attempts for known vulnerabilities like these before updates are applied.
Disclaimer: The above content is generated by AI and is for reference only.