A WordPress contact form is supposed to accept a resume, not a webshell. Researchers found that Forminator Forms, a drag and drop form builder running on more than 600,000 sites, could be talked into accepting an executable PHP file from someone who had never logged in.
The bug is tracked as CVE-2026-15748 and carries a CVSS score of 9.8 out of 10, critical. It affects every release up to and including version 1.56.1, and the Forminator team shipped the fixed build, 1.56.2, on July 31, 2026. The researcher who found it, who goes by daroo, reported it through the Wordfence Bug Bounty Program and earned a 2,048 dollar bounty. Wordfence's Istvan Marton published the original report on August 17.
A dropdown doing somebody else's job
Exploitation needs one specific setup: a published form containing both a File Upload field and a Select field. The two have no functional relationship. The Select field simply happens to be the field type that reaches the code path the attack needs.
Forminator's request sanitizer deliberately passes the nested values of select, radio and checkbox fields through untouched, leaving each field type to clean up after itself later. That lets an attacker use a harmless dropdown as a carrier for a forged record, declaring it to be an upload and supplying its own field configuration. When the plugin runs its upload phase, it trusts that attacker-supplied configuration, which means the attacker gets to decide which file types the form will accept.
The last hurdle is the blocklist meant to strip dangerous extensions. It removes the literal key php, but it matches keys exactly, so the regex style key ph(p) survives untouched. Supplying ph(p)|text/x-php walks a PHP file past the check, because WordPress still reads ph(p) as a pattern matching a .php ending.
Why the default setup blunts it
There is a real mitigating factor here, and Wordfence is upfront about it. By default, Forminator writes uploads into a directory protected by an .htaccess file that stops the web server executing PHP inside it. An attacker can plant the file, but not run it.
That protection can go missing. If an administrator has configured a Custom File Upload Storage root, the folder gets created the first time it is needed, during a frontend request where the WordPress helper that writes the .htaccess file is not loaded. On those sites, requesting the uploaded file directly executes whatever the attacker put in it, and that is full site compromise through a webshell.
Update to Forminator 1.56.2
Update the plugin to 1.56.2 or later. If your site runs Forminator with a custom upload storage root, treat it as the priority case and check whether an .htaccess file is actually present in that directory. Wordfence says its firewall's built-in malicious file upload protection blocks exploit attempts for free and paid users alike, but a rule that blocks an attack is not a substitute for the patch.
This is the latest in a run of serious plugin takeovers we have covered this month, after a 61-character username that could hijack a site, and it lands in a period Wordfence's own numbers describe as unusually busy: 249 plugin and theme flaws in a single week. The plugin layer, not WordPress core, is still where the ecosystem's real risk sits.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.