Forminator WordPress Plugin Carries Critical Flaw Rated 9.8; 600,000 Sites Affected
A newly disclosed vulnerability in the Forminator plugin lets attackers upload malicious files without logging in, putting hundreds of thousands of WordPress sites at risk of full takeover.
Key points
- Forminator Forms, a WordPress plugin used on more than 600,000 sites, carries a critical flaw tracked as CVE-2026-15748.
- The bug scores 9.8 out of 10 on the industry severity scale, meaning it is about as serious as a web flaw gets.
- An unauthenticated attacker, someone with no account on the site, can upload a malicious PHP file and run their own code on the server.
- Site owners should update the plugin immediately and check upload folders for files they do not recognise.
A critical security hole in a widely used WordPress add-on is putting more than 600,000 websites at risk of being taken over by strangers on the internet.
The add-on is called Forminator Forms. It lets site owners build contact forms, polls and quizzes without writing code. On November it was disclosed to carry a flaw that a researcher found in the way it handles file uploads.
The flaw is tracked as CVE-2026-15748, the standard reference number the security industry uses for a specific bug. It is rated 9.8 out of 10 on the Common Vulnerability Scoring System, or CVSS, the scale used to measure how dangerous a flaw is. Anything above 9 is treated as critical.
What can an attacker actually do?
An attacker who has never logged into the site can upload a booby-trapped file and make the web server run it. That is the worst case for a website: the intruder can read the database, plant a backdoor, deface pages, or use the site to attack visitors.
The technical name for this is unauthenticated remote code execution. In plain terms: a stranger, without a password, gets to run their own commands on your server.
The route in is the plugin's upload feature. Forminator did not properly check what kind of file was being sent. That let a researcher submit a PHP script, the language WordPress itself is written in, disguised as a normal form attachment. Once the file lands on the server, visiting its web address executes it.
Who is affected?
Any WordPress site running a vulnerable version of Forminator Forms is exposed, and the plugin is installed on more than 600,000 sites according to its official listing. That includes small business pages, charities, schools and personal blogs that use the plugin for a contact or booking form.
The vulnerability was first reported by The Hacker News. Site owners do not need to be running any particular theme or hosting provider to be at risk. If the plugin is active, the site is a target.
What should site owners do now?
Update the plugin to the latest version through the WordPress dashboard, then check the site for signs of misuse. A flaw scoring 9.8 will be scanned for automatically by criminals within days of public disclosure, so speed matters.
After updating, look inside the site's uploads folder for files ending in .php that you did not put there. Review admin accounts for names you do not recognise. If anything looks off, restore from a clean backup taken before the disclosure date and rotate all passwords and API keys tied to the site.
| Detail | Value |
|---|---|
| Plugin | Forminator Forms |
| Installations | 600,000+ |
| CVE | CVE-2026-15748 |
| CVSS score | 9.8 (critical) |
| Impact | Unauthenticated remote code execution |
Common questions
Do ordinary visitors to an affected site face any danger?
Indirectly, yes. If a criminal takes over a site through this flaw, they can plant malicious scripts that target visitors, steal payment details entered into forms, or redirect people to scam pages. Avoid entering card details on sites that look broken or unfamiliar.
Is there any sign this is being exploited in the wild yet?
No public reports of mass exploitation had surfaced at the time of disclosure, but critical WordPress plugin flaws are typically weaponised within a week. Treat the patch as urgent rather than routine.
