Forminator Forms: arbitrary file upload (CVE-2026-15748)
A vulnerability, CVE-2026-15748 (CVSS 9.8), was published in the Forminator Forms plugin for WordPress. The handle_file_upload function validates file types insufficiently: the extension blocklist can be bypassed with pipe-alternative MIME type keys.
Checked in Shield: no
Who is affected
All Forminator Forms versions up to and including 1.56.1 are affected. An unauthenticated attacker can upload a potentially executable file, which makes remote code execution possible.
How to check
In the WordPress admin, open Plugins and check the Forminator Forms version. If it is 1.56.1 or lower, the site is exposed.
How to fix
Update to a version newer than 1.56.1 as soon as the vendor releases it. The source does not name a fixed version. Until a patch exists, consider temporarily deactivating the plugin.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Exploitation status and the fixed version number are not disclosed yet. Source: NVD (CVE-2026-15748).
