Forminator Forms CVE-2026-15748

Exploitation requires that the target WordPress site runs Forminator Forms ≤1.56.1 with at least one publicly reachable form (default deployment for a plugin whose purpose is public contact/payment forms). The attacker must forge a Select field value to inject upload-field configuration into the public submission handler and craft an uploaded file whose dangerous extension is expressed via a pipe-alternative MIME key (e.g. a composite 'php|...' key) so it bypasses the exact-key blocklist match in handle_file_upload. No authentication (PR:N) and no user interaction (UI:N) are needed. Limiting factors: server-side execution controls that prevent PHP execution in the uploads directory would neutralize the RCE even on a successful write, and sites with no public-facing form or with upload fields removed are not exploitable; successful code execution runs with the privileges of the web server user.

This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high impact to confidentiality, integrity, and availability, which aligns cleanly with the described unauthenticated-to-RCE chain - the signals are internally consistent rather than conflicting. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, so exploitation-probability and automatability cannot be quantified here; this is a data gap, not evidence of low risk. Given that Forminator is a widely installed WordPress plugin and file-upload-to-RCE bugs are historically weaponized quickly once details circulate, even a mid-sized municipal IT team in ustka should treat this as urgent and patch on an emergency basis rather than waiting for a KEV listing. Absence of a published proof-of-concept lowers the immediate mass-exploitation likelihood but does not reduce the underlying severity.

An unauthenticated attacker locates a public Forminator form and submits a crafted POST that forges a Select field value to inject an attacker-controlled upload field configuration, then attaches a PHP payload whose MIME/extension key uses a pipe-alternative form that evades the exact-match blocklist. The file is written into the site's uploads area, and the attacker requests the uploaded script to execute code on the server. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of required authentication or user interaction make this straightforward to weaponize.