300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw

Security researcher Defiant identified a critical remote code execution vulnerability, tracked as CVE-2026-15748, within the Forminator Forms plugin for WordPress. With a CVSS score of 9.8, this flaw allows unauthenticated users to execute arbitrary code by exploiting insufficient file type validation in the handle_file_upload function.

The issue stems from a combination of weaknesses that let attackers forge record configurations and bypass the plugin's dangerous extension blocklist using pipe-alternative MIME types. While default settings restrict PHP execution to protected directories, custom storage roots remain vulnerable, potentially leading to full site compromise via webshells. The plugin has over 600,000 installations, with approximately half running affected versions, leaving more than 300,000 websites at risk unless updated to version 1.56.2, which was released on July 31.