Multiple security vulnerabilities have been identified in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability impacts all versions of the plugin before and including 1.56.1. It has been addressed in version 1.56.2 released on July 31, 2026.
CVE-2026-15748 (CVSS 9.8 — Severity): This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise. The sites must have a form containing both a File Upload field and a Select field.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability impacts all versions of the plugin before and including 1.56.1. It has been addressed in version 1.56.2 released on July 31, 2026.
CVE-2026-15748 (CVSS 9.8 — Severity): This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise. The sites must have a form containing both a File Upload field and a Select field.[emaillocker id="1283"]
CVE-2026-15826 (CVSS 9.8 — Severity): This is due to the wppb_log_in_user function calling absint on the return value of wp_insert_user before performing an is_wp_error check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1.
These vulnerabilities collectively present a significant risk of site compromise for administrators who have not updated their plugins.
We recommend you to update Forminator Forms to version 1.56.2 or 3.16.5.
The following reports contain further technical details:
[/emaillocker]