EUVD-2026-60569
GHSA-3p88-69p6-f6mj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network submission handler (AV:N/PR:N/UI:N) with a straightforward blocklist bypass (AC:L) yielding code execution, giving full C/I/A impact on the host.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Articles & Coverage 1
AnalysisAI
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WPMU DEV) in all versions through 1.56.1. The public form-submission handler trusts attacker-controlled upload field configuration injected through a forged Select field value, and the dangerous-extension blocklist in handle_file_upload uses exact-key matching that is bypassed with pipe-alternative MIME type keys, letting an attacker drop an executable PHP file on the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site runs Forminator Forms ≤1.56.1 with at least one publicly reachable form (default deployment for a plugin whose purpose is public contact/payment forms). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Forminator Forms to the first release above 1.56.1 that the vendor marks as fixed; the input data does not include an exact patched version number, so the released patched version is not independently confirmed and administrators should verify the fixed release on the WordPress.org plugin page before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations running Forminator Forms and immediately disable file upload functionality in all active forms via the plugin settings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthentica
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthentic
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject ar
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauth
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to a
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today