The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all ve

The Forminator Forms

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative…

Do this now

Update Forminator beyond 1.56.1 once a fix ships, and block file uploads from untrusted users meanwhile.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 21:17 UTC
Identifiers: CVE-2026-15748
CVSS: 9.8
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all ve
Severity: critical. Patch status: fix status unknown.
Affected: The Forminator Forms
Ids: CVE-2026-15748

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative…

## Steps
1. Search the repo, its CI and infra config for The Forminator Forms. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative…

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-15748") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-15748 https://plugins.trac.wordpress.org/browser/forminator/tags/1.55.1/admin/classes/class-admin-ajax.php#L1196
https://pwned.coffee/i/the-forminator-forms-plugin-for-wordpress-is-vulnerable-cve-2026-15748

Timeline

23 Oct 2026, 21:17 UTC
Proof-of-concept code for CVE-2026-15748 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee