Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields
1. Basic Information
- Article Title: 600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
- Publisher: Wordfence Intelligence
- Publication Date: 2026-08-17
- Severity: High
- Original Source: Wordfence
- Related Sources: SecurityWeek
- Related Malware / Attack Groups: None / Unidentified
- CVE & Product: CVE-2026-15748, WordPress, Forminator Forms before 1.56.1
2. Summary
An attacker can inject fake upload settings into a public form's Select field and bypass PHP blocks using strings like ph(p)|text/x-php. This uploads a file to the server. If the custom upload directory lacks execution prevention, it becomes an unauthenticated Remote Code Execution (RCE) vulnerability.
3. Attack Flow
- An attacker finds a public Forminator form that has both a File Upload field and a Select field.
- The attacker injects a fake record into the nested value of the Select field. This record includes
return,field_type=upload, a customname, andfield_array. - The function
set_field_data()adds this fake record to the internalfield_data_array. - Because a real File Upload field exists,
process_uploads()runs, and it trusts the fake record as a valid upload setting. - The attacker controls the custom file type and
additional-type. - To bypass exact-match blocks for forbidden extensions, the attacker uses
ph(p)|text/x-php. - Because it is not an exact match for the key
php, it passes the blocklist. However, the WordPress matcher matchesph(p)to.php. - The server saves the PHP file.
- If the custom File Upload storage root lacks execution prevention (such as an
.htaccessfile), the attacker accesses the saved URL to run the PHP code. - Inference: The attacker installs a web shell, steals WordPress settings, databases, or credentials, and defaces the site.
4. Attacker Position and Execution Location
- The attacker is external and can access public WordPress forms.
- No user account or administrator action is required.
- The forging process happens inside Forminator's front-end submission handler.
- PHP execution succeeds if the web server processes the Custom File Upload Storage root as PHP.
5. Visibility for Victims and Administrators
Users
- No user action is required, and the normal form display may not change.
Administrators and SOCs
- A POST request where a Select field contains unusual nested arrays or
field_type=upload. - Abnormal patterns in
additional-type, such asph(p)|text/x-php. - PHP files with random prefixes inside the upload directory.
- A GET request to the saved URL from the same external IP immediately after the upload.
- Web server child processes, unexpected outbound traffic, or modified WordPress files.
6. Success and Failure Conditions
Success Conditions
- Forminator Forms version 1.56.1 or earlier.
- A public form with both File Upload and Select fields.
- The system processes the forged field configuration.
- The PHP file is successfully saved.
- For RCE, the Custom File Upload Storage root must allow PHP execution.
Failure Conditions
- Updated to version 1.56.2 or later.
- The form lacks the combination of File Upload and Select fields.
- A WAF blocks abnormal nested parameters or malicious file uploads.
- Web server settings explicitly block PHP execution in the upload directory.
- PHP access is detected and blocked immediately after saving.
7. What Happens on Success
- An unauthenticated attacker can save PHP files.
- If the save location allows execution, it leads to remote code execution and full site compromise.
- Inference: The attacker can deploy a web shell, add an administrator, modify plugins or themes, steal the database, or distribute redirects and malware.
- Even if the file upload succeeds, default protected upload directories can still block PHP execution.
8. Observable Logs
- Form submission notifications may contain abnormal Select values or attachment names.
Proxy / SWG / DNS
- Crafted POST requests to public Forminator forms.
- Direct GET requests to the uploaded PHP file.
- Outbound C2 connections or payload downloads after a web shell is established.
Endpoint / EDR
- PHP or phtml files inside the WordPress upload or custom storage directories.
- Shells, curl, wget, or PowerShell spawned by the web server process (environment-dependent).
- Abnormal changes to
wp-config.php, plugins, themes, cron jobs, or the database.
Identity / IdP
- Initial exploit requests are anonymous.
- Inference: Adding WordPress administrators or abusing existing sessions after the breach.
SaaS / Cloud
- HTTP or file quarantine logs from CDNs, WAFs, or managed WordPress environments.
- Object creation or read logs if object storage is used as the upload root.
Network
- Web access logs showing a POST request followed immediately by a GET request to an uploaded PHP file.
- Communication from the web server to unknown destinations.
9. Determining Attack Success
- Contact Only: Form discovery, failed submission, or WAF block.
- User Action: None required.
- Initial Execution: Confirmation that the forged field configuration is processed and the PHP file is saved.
- Malware Success: Confirmation of PHP code execution via a request to the saved URL, observed through web server child processes or changed responses.
-
Data Theft / Session Compromise: Confirmation of database dumps,
wp-config.phpaccess, cookie/credential theft, or outbound data transfer. - Follow-up Compromise: Confirmation of web shells, new administrators, modified plugins, or persistent cron jobs.
10. Investigation Playbook
-
Trigger: Affected versions of CVE-2026-15748, abnormal Select arrays,
ph(p)|text/x-php, or PHP files in upload directories. - Initial Check: Check plugin versions, targeted form fields, storage roots, PHP execution status, and external exposure.
- Endpoints: Preserve upload directories, web roots, plugin/theme file diffs, access/error logs, process trees, and database changes.
- Authentication and Cloud: Check for new WordPress administrators, password resets, API keys, and storage access.
- Subsequent Actions: Search for web shells, cron jobs, mu-plugins, theme functions, redirects, and outbound traffic.
- Containment: Update to version 1.56.2 or later, disable script execution in upload directories, isolate malicious files, and revoke sensitive data and admin sessions.
- Categorization: Probe / Forged Submission / File Upload / PHP Execution / Site Compromise / Data Theft.
11. Defense and Detection Ideas
-
Single Event: Detect
ph(p)|text/x-php,field_type=uploadinside Select fields, and PHP files in upload directories. - Time-Series Correlation: Form POST → PHP creation → Saved URL GET → Web server child process / outbound traffic.
-
Hunting Perspective: PHP files with random prefixes, newly created custom upload roots, or missing
.htaccessfiles. - Log Gaps: Detection is difficult without POST bodies, multipart fields, file creation logs, and web process child processes.
- Priority Actions: Update plugins and disable script execution in upload storage folders independently.
12. Facts / Inference / Hypothesis
Facts
- Versions 1.56.1 and earlier are vulnerable to CVE-2026-15748; the issue is fixed in 1.56.2.
- Exploitation requires a public form with both File Upload and Select fields.
- Fake upload records can be injected into internal processing via Select fields.
-
ph(p)|text/x-phpbypasses the exact-match blocklist for dangerous extensions. - Default upload directories block PHP execution, but Custom File Upload Storage roots may lack protection.
- No active exploits have been reported at the time of publication.
Inference
- An RCE does not occur simply because a vulnerable version is present; form structure and execution permissions on the storage path must be verified.
- Disabling script execution is an effective independent defense against similar upload flaws.
Hypothesis
- Automated scanners searching for vulnerable forms may increase after detailed exploit steps are published.
- Attackers may test other regex-compatible bypass notations.
13. MITRE ATT&CK Mapping
- T1190 – Exploit Public-Facing Application (High)
- T1105 – Ingress Tool Transfer (High - PHP payload upload)
- T1505.003 – Server Software Component: Web Shell (Medium - If a web shell is deployed later)
- T1059.004 – Unix Shell (Low - Only if the resulting PHP script starts a shell)
14. Unknowns and Further Investigation
- Whether active exploitation has started and the source of attacks.
- The complete diff of the patch and other potential bypass notations.
- Upload root protection status across various managed hosting providers.
- Stable HTTP request shapes during exploitation.
- Global adoption rates of Forminator and Custom Storage usage.
15. Impact on SOCs and Organizations
WordPress is widely used globally for business websites, contact forms, recruitment pages, and marketing campaigns. The key is to verify the actual conditions required for exploitation—such as the presence of "File Upload + Select" fields, "Custom Storage," and "PHP execution permission"—rather than relying solely on the plugin version, and to prioritize those environments. Even when default protections are in place, arbitrary file uploads can still occur, making timely updates essential.
16. Summary by Target Audience
For SOCs
Detect ph(p)|text/x-php and forged upload settings. Correlate form POST requests with PHP creation, GET requests, and child processes. Separate successful file uploads from successful RCEs in your assessments.
For Administrators
Update Forminator to version 1.56.2 or later. Disable script execution (such as PHP) in all upload destinations. Prioritize inspections of forms that use custom storage.
For Users
General users do not need to take any action. If you notice site defacement or suspicious redirects, stop entering data and contact the site administrator immediately.
Top comments (0)