A file-upload field and a dropdown, sitting on the same form, are all it takes for an unauthenticated attacker to plant PHP code on your site. The fix has existed since July 31 — most sites just haven't installed it.
If your WordPress site runs Forminator Forms and any of its forms combine a File Upload field with a Select (dropdown) field, an attacker who has never logged in can plant a working PHP file on your server right now. That's CVE-2026-15748 — a 9.8-out-of-10 flaw in a plugin installed on more than 600,000 sites, and the fix has been sitting in the plugin repository for over two weeks.
How a dropdown menu becomes a backdoor
The flaw lives in Forminator's handle_file_upload() function, and it's a two-part trick. First, the dangerous-file-extension blocklist checks uploads by an exact-key match, which a pipe-alternative MIME type key slides straight past. Second, the public form-submission handler trusts an attacker-controlled upload field configuration that gets injected through a forged Select field value — effectively letting the attacker tell the plugin 'this dangerous upload is actually a harmless dropdown answer,' and the plugin believes it.
The payoff is a PHP file landing wherever that form's upload storage path points — which, on plenty of sites, is inside the public web root. From there the attacker just requests the file directly and gets code execution on the server. No credentials, no social engineering, no admin action required at any point.
What's affected
Plugin
Detail
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Developer
Detail
WPMU DEV
Vulnerable versions
Detail
All through 1.56.1
Fixed version
Detail
1.56.2 (released July 31, 2026)
CVSS score
Detail
9.8 (Critical)
Trigger condition
Detail
A form with both a File Upload field and a Select field
Detail
Value
Plugin
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Developer
WPMU DEV
Vulnerable versions
All through 1.56.1
Fixed version
1.56.2 (released July 31, 2026)
CVSS score
9.8 (Critical)
Trigger condition
A form with both a File Upload field and a Select field
Why this one slipped past so many sites
The gap here isn't a slow vendor — WPMU DEV actually shipped the fix quietly on July 31, well before Wordfence's public writeup on August 17. The problem is that a version bump with no loud 'security fix' flag in the changelog gives site owners nothing to act on. Anyone running auto-updates got protected without noticing. Anyone who updates plugins manually, or on a monthly review cycle, sat exposed for over two weeks with a fully working exploit path and no idea it existed.
Checking whether Forminator Forms is below version 1.56.2 takes about ten seconds from the Plugins screen. · Unsplash
Fix it in the next five minutes
Open WordPress admin, go to Plugins, and check the Forminator Forms version number
2
If it's below 1.56.2, click Update Now — no other steps are required for the base fix
3
Audit any forms that combine a File Upload field with a Select field for unexpected submissions or unfamiliar files in your uploads directory
4
If you can't patch immediately, temporarily unpublish any form pairing those two field types
File-handling logic keeps being where 2026's worst RCEs hide — Rails Active Storage's own upload-handling RCE and Gitea's file-read RCE both trace back to the same category of mistake. If your stack has any plugin or component that accepts uploads, it's worth a second look, not just this one.
Do I need to touch every form on my site, or just some?
Just the ones combining a File Upload field with a Select field — but updating to 1.56.2 patches the underlying handler regardless, so it protects every form even if you don't audit each one individually.
Is there evidence this has been exploited in the wild?
Coverage as of publication doesn't report confirmed in-the-wild attacks, but a CVSS 9.8, no-login, mass-installed plugin bug is exactly the profile that gets automated scanning within days of going public — treat the window as closing, not closed.
Does updating Forminator break my existing forms?
1.56.2 changes file-upload validation logic, not form structure, so existing forms and submissions should be unaffected. Test one form after updating if you run heavily customized upload configurations.
I don't use Forminator's file upload fields — am I safe?
If none of your forms have a File Upload field, this specific exploit path doesn't apply right now. Update anyway — the plugin can gain new field combinations any time you or another editor builds a new form.
Check the version number before you do anything else today. This is the third time this year a mass-installed WordPress plugin has turned into a crawl-worthy CVE story on this desk, and the pattern holds every time: the sites that get hit aren't the ones without a fix available, they're the ones that never checked.
