Unauthenticated arbitrary file upload in Forminator Forms for WordPress via handle_file_upload (CVE-2026-15748)
Two public exploits are catalogued in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-10-13, so any site still on Forminator 1.56.1 or earlier with a public form can be turned into a webshell host.
Forminator's handle_file_upload blocklist uses exact-key matching that is bypassed with pipe-alternative MIME keys, and the public submission handler trusts attacker-supplied upload field configuration injected through a forged Select field value. An unauthenticated attacker can upload executable files to the server and achieve remote code execution.
Affected: Forminator Forms – Contact Form, Payment Form & Custom Form Builder (forminator) for WordPress <= 1.56.1
How to Test
In WordPress Admin > Plugins, confirm the Forminator version; 1.56.1 and earlier are affected. Review access logs for unauthenticated POST submissions to the Forminator front-end submission handler that include upload fields, and search wp-content/uploads (including Forminator's upload folders) for recently created .php or other executable files that no legitimate form should have accepted.
How to Patch
Update Forminator to the latest release later than 1.56.1 from WordPress.org. If you cannot update today, disable file upload fields on public forms or deactivate the plugin until it is updated.