Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields

Forminator Forms, a WordPress plugin, has been found to have a high severity arbitrary file upload vulnerability, CVE-2026-15748. This vulnerability allows unauthenticated remote code execution (RCE) via forged upload settings in select fields. The vulnerability affects WordPress sites using Forminator Forms versions before 1.56.1.

Attackers can inject fake upload settings into a public form's select field, bypassing PHP blocks. They do this by using strings like `ph(p)|text/x-php` in a select field. This triggers the processing of uploads, which trusts the fake record as a valid upload setting. The attacker controls the custom file type and additional type, bypassing exact-match blocks for forbidden extensions.

If the custom file upload storage root lacks execution prevention, the server saves the PHP file. If PHP execution is allowed in the custom file upload storage root, the attacker can access the saved URL to run the PHP code, effectively installing a web shell and compromising the site. This can lead to the theft of WordPress settings, databases, or credentials, and the defacement of the site.

Administrators and security operations centers (SOCs) can detect this attack by monitoring for POST requests with unusual nested arrays or `field_type=upload` in select fields. They should also look for abnormal patterns in additional-type, such as `ph(p)|text/x-php`, and PHP files with random prefixes inside the upload directory. They can also check for PHP files with unexpected outbound traffic or modified WordPress files.

To mitigate this vulnerability, users should update Forminator Forms to version 1.56.2 or later. They should also ensure that their web server settings explicitly block PHP execution in the upload directory. If PHP execution is necessary, it should be restricted to child processes and monitored for abnormal behavior.