Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields

Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields 1. Basic Information Article Title : 600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin Publisher : Wordfence Intelligence Publication Date : 2026-08-17 Severity : High Original Source : Wordfence Related Sources : SecurityWeek Related Malware / Attack Groups : None / Unidentified CVE & Product : CVE-2026-15748, WordPress, Forminator Forms before 1.56.1 2. Summary An attacker can inject fake upload settings into a public form's Select field and bypass PHP blocks using strings like ph(p)|text/x-php . This uploads a file to the server. If the custom upload directory lacks execution prevention, it becomes an unauthenticated Remote Code Execution (RCE) vulnerability. 3. Attack Flow An attacker finds a public Forminator form that has both a File Upload field and a Select field. The attacker injects a fake record into the nested value of the Select field. This record includes return , field_type=upload , a custom name , and field_array . The function set_field_data() adds this fake record to the internal field_data_array . Because a real File Upload field exists, process_uploads() runs, and it trusts the fake record as a valid upload setting. The attacker controls the custom file type and additional-type . To bypass exact-match blocks for forbidden extensions, the attacker uses ph(p)|text/x-php . Because it is not an exact match for the key php , it passes the blocklist. However, the WordPress matcher matches ph(p) to .php . The server saves the PHP file. If the custom File Upload storage root lacks execution prevention (such as an .htaccess file), the attacker accesses the saved URL to run the PHP code. Inference : The attacker installs a web shell, steals WordPress settings, databases, or credentials, and defaces the site. 4. Attacker Position and Execution Location The attacker is external and can access public Wor