DEV Community

Anoymask
Anoymask

Posted on

Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields

Forminator Forms (CVE-2026-15748): Unauthenticated RCE via Forged Upload Settings in Select Fields

1. Basic Information

  • Article Title: 600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
  • Publisher: Wordfence Intelligence
  • Publication Date: 2026-08-17
  • Severity: High
  • Original Source: Wordfence
  • Related Sources: SecurityWeek
  • Related Malware / Attack Groups: None / Unidentified
  • CVE & Product: CVE-2026-15748, WordPress, Forminator Forms before 1.56.1

2. Summary

An attacker can inject fake upload settings into a public form's Select field and bypass PHP blocks using strings like ph(p)|text/x-php. This uploads a file to the server. If the custom upload directory lacks execution prevention, it becomes an unauthenticated Remote Code Execution (RCE) vulnerability.

3. Attack Flow

  1. An attacker finds a public Forminator form that has both a File Upload field and a Select field.
  2. The attacker injects a fake record into the nested value of the Select field. This record includes return, field_type=upload, a custom name, and field_array.
  3. The function set_field_data() adds this fake record to the internal field_data_array.
  4. Because a real File Upload field exists, process_uploads() runs, and it trusts the fake record as a valid upload setting.
  5. The attacker controls the custom file type and additional-type.
  6. To bypass exact-match blocks for forbidden extensions, the attacker uses ph(p)|text/x-php.
  7. Because it is not an exact match for the key php, it passes the blocklist. However, the WordPress matcher matches ph(p) to .php.
  8. The server saves the PHP file.
  9. If the custom File Upload storage root lacks execution prevention (such as an .htaccess file), the attacker accesses the saved URL to run the PHP code.
  10. Inference: The attacker installs a web shell, steals WordPress settings, databases, or credentials, and defaces the site.

4. Attacker Position and Execution Location

  • The attacker is external and can access public WordPress forms.
  • No user account or administrator action is required.
  • The forging process happens inside Forminator's front-end submission handler.
  • PHP execution succeeds if the web server processes the Custom File Upload Storage root as PHP.

5. Visibility for Victims and Administrators

Users

  • No user action is required, and the normal form display may not change.

Administrators and SOCs

  • A POST request where a Select field contains unusual nested arrays or field_type=upload.
  • Abnormal patterns in additional-type, such as ph(p)|text/x-php.
  • PHP files with random prefixes inside the upload directory.
  • A GET request to the saved URL from the same external IP immediately after the upload.
  • Web server child processes, unexpected outbound traffic, or modified WordPress files.

6. Success and Failure Conditions

Success Conditions

  • Forminator Forms version 1.56.1 or earlier.
  • A public form with both File Upload and Select fields.
  • The system processes the forged field configuration.
  • The PHP file is successfully saved.
  • For RCE, the Custom File Upload Storage root must allow PHP execution.

Failure Conditions

  • Updated to version 1.56.2 or later.
  • The form lacks the combination of File Upload and Select fields.
  • A WAF blocks abnormal nested parameters or malicious file uploads.
  • Web server settings explicitly block PHP execution in the upload directory.
  • PHP access is detected and blocked immediately after saving.

7. What Happens on Success

  • An unauthenticated attacker can save PHP files.
  • If the save location allows execution, it leads to remote code execution and full site compromise.
  • Inference: The attacker can deploy a web shell, add an administrator, modify plugins or themes, steal the database, or distribute redirects and malware.
  • Even if the file upload succeeds, default protected upload directories can still block PHP execution.

8. Observable Logs

Email

  • Form submission notifications may contain abnormal Select values or attachment names.

Proxy / SWG / DNS

  • Crafted POST requests to public Forminator forms.
  • Direct GET requests to the uploaded PHP file.
  • Outbound C2 connections or payload downloads after a web shell is established.

Endpoint / EDR

  • PHP or phtml files inside the WordPress upload or custom storage directories.
  • Shells, curl, wget, or PowerShell spawned by the web server process (environment-dependent).
  • Abnormal changes to wp-config.php, plugins, themes, cron jobs, or the database.

Identity / IdP

  • Initial exploit requests are anonymous.
  • Inference: Adding WordPress administrators or abusing existing sessions after the breach.

SaaS / Cloud

  • HTTP or file quarantine logs from CDNs, WAFs, or managed WordPress environments.
  • Object creation or read logs if object storage is used as the upload root.

Network

  • Web access logs showing a POST request followed immediately by a GET request to an uploaded PHP file.
  • Communication from the web server to unknown destinations.

9. Determining Attack Success

  • Contact Only: Form discovery, failed submission, or WAF block.
  • User Action: None required.
  • Initial Execution: Confirmation that the forged field configuration is processed and the PHP file is saved.
  • Malware Success: Confirmation of PHP code execution via a request to the saved URL, observed through web server child processes or changed responses.
  • Data Theft / Session Compromise: Confirmation of database dumps, wp-config.php access, cookie/credential theft, or outbound data transfer.
  • Follow-up Compromise: Confirmation of web shells, new administrators, modified plugins, or persistent cron jobs.

10. Investigation Playbook

  • Trigger: Affected versions of CVE-2026-15748, abnormal Select arrays, ph(p)|text/x-php, or PHP files in upload directories.
  • Initial Check: Check plugin versions, targeted form fields, storage roots, PHP execution status, and external exposure.
  • Endpoints: Preserve upload directories, web roots, plugin/theme file diffs, access/error logs, process trees, and database changes.
  • Authentication and Cloud: Check for new WordPress administrators, password resets, API keys, and storage access.
  • Subsequent Actions: Search for web shells, cron jobs, mu-plugins, theme functions, redirects, and outbound traffic.
  • Containment: Update to version 1.56.2 or later, disable script execution in upload directories, isolate malicious files, and revoke sensitive data and admin sessions.
  • Categorization: Probe / Forged Submission / File Upload / PHP Execution / Site Compromise / Data Theft.

11. Defense and Detection Ideas

  • Single Event: Detect ph(p)|text/x-php, field_type=upload inside Select fields, and PHP files in upload directories.
  • Time-Series Correlation: Form POST → PHP creation → Saved URL GET → Web server child process / outbound traffic.
  • Hunting Perspective: PHP files with random prefixes, newly created custom upload roots, or missing .htaccess files.
  • Log Gaps: Detection is difficult without POST bodies, multipart fields, file creation logs, and web process child processes.
  • Priority Actions: Update plugins and disable script execution in upload storage folders independently.

12. Facts / Inference / Hypothesis

Facts

  • Versions 1.56.1 and earlier are vulnerable to CVE-2026-15748; the issue is fixed in 1.56.2.
  • Exploitation requires a public form with both File Upload and Select fields.
  • Fake upload records can be injected into internal processing via Select fields.
  • ph(p)|text/x-php bypasses the exact-match blocklist for dangerous extensions.
  • Default upload directories block PHP execution, but Custom File Upload Storage roots may lack protection.
  • No active exploits have been reported at the time of publication.

Inference

  • An RCE does not occur simply because a vulnerable version is present; form structure and execution permissions on the storage path must be verified.
  • Disabling script execution is an effective independent defense against similar upload flaws.

Hypothesis

  • Automated scanners searching for vulnerable forms may increase after detailed exploit steps are published.
  • Attackers may test other regex-compatible bypass notations.

13. MITRE ATT&CK Mapping

  • T1190 – Exploit Public-Facing Application (High)
  • T1105 – Ingress Tool Transfer (High - PHP payload upload)
  • T1505.003 – Server Software Component: Web Shell (Medium - If a web shell is deployed later)
  • T1059.004 – Unix Shell (Low - Only if the resulting PHP script starts a shell)

14. Unknowns and Further Investigation

  • Whether active exploitation has started and the source of attacks.
  • The complete diff of the patch and other potential bypass notations.
  • Upload root protection status across various managed hosting providers.
  • Stable HTTP request shapes during exploitation.
  • Global adoption rates of Forminator and Custom Storage usage.

15. Impact on SOCs and Organizations

WordPress is widely used globally for business websites, contact forms, recruitment pages, and marketing campaigns. The key is to verify the actual conditions required for exploitation—such as the presence of "File Upload + Select" fields, "Custom Storage," and "PHP execution permission"—rather than relying solely on the plugin version, and to prioritize those environments. Even when default protections are in place, arbitrary file uploads can still occur, making timely updates essential.

16. Summary by Target Audience

For SOCs

Detect ph(p)|text/x-php and forged upload settings. Correlate form POST requests with PHP creation, GET requests, and child processes. Separate successful file uploads from successful RCEs in your assessments.

For Administrators

Update Forminator to version 1.56.2 or later. Disable script execution (such as PHP) in all upload destinations. Prioritize inspections of forms that use custom storage.

For Users

General users do not need to take any action. If you notice site defacement or suspicious redirects, stop entering data and contact the site administrator immediately.

Top comments (0)