# Massive Security Flaw in WordPress Plugin Leaves 300,000 Sites Vulnerable

*Published August 19, 2026*
*Source: [https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/](https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/)*

## Executive Summary

A severe vulnerability in the Forminator Forms plugin for WordPress could expose over 300,000 websites to remote code execution due to insufficient file type validation. The issue affects versions up to 1.56.1 and has been patched in version 1.56.2.

## Article

A critical vulnerability has been identified in the Forminator Forms plugin for WordPress, leaving potentially hundreds of thousands of websites exposed to remote code execution. This vulnerability, tracked as CVE-2026-15748, holds a severity score of 9.8 and allows unauthenticated attackers to upload executable files. The flaw arises from insufficient file type validation in the plugin's handle_file_upload function, which can be exploited by attackers to execute code remotely.

Security firm Defiant reveals that the vulnerability stems from a combination of weaknesses. Attackers can forge records using a form's Select field, manipulate the field configuration, and bypass the plugin’s blocklist of dangerous file types. Although files are by default stored in a protected directory that prevents PHP execution, any customized file upload storage configuration that bypasses this protection can lead to the execution of malicious code.

The vulnerability affects all versions of Forminator Forms up to 1.56.1, with the issue being patched in version 1.56.2, released on July 31. With over 600,000 installations, and half of them running a vulnerable version, an estimated 300,000 websites are at risk. Currently, there are no known instances of the vulnerability being exploited in the wild.