Loading story…
A critical vulnerability in the Forminator Forms WordPress plugin exposed roughly 600,000 sites to unauthenticated arbitrary file upload and potential remote code execution. Tracked as CVE-2026-15748, the flaw affects all versions through 1.56.1 and can be exploited when a form includes both a File Upload field and a Select field. Researchers said attackers could forge upload metadata and bypass file-type checks in the plugin's handle_file_upload() logic to upload malicious PHP files.
In default configurations, uploaded files are usually stored in a directory protected by .htaccess, which can block direct execution, but sites using a custom upload storage root may lack that safeguard and be fully compromised. The vendor patched the issue in Forminator Forms 1.56.2. Separate reporting also highlighted another critical WordPress plugin issue: User Profile Builder CVE-2026-15826, an authentication bypass fixed in 3.16.5 that could let unauthenticated attackers log in as user ID 1 when Automatically Log In is enabled.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The vendor released Forminator Forms version 1.56.2 to patch CVE-2026-15748. The critical flaw could allow unauthenticated attackers to upload executable PHP files and potentially fully compromise vulnerable WordPress sites.
The Forminator vendor submitted a patch for CVE-2026-15748 for review after receiving disclosure details. The issue affected all plugin versions up to and including 1.56.1.
The User Profile Builder WordPress plugin patched CVE-2026-15826 in version 3.16.5. The vulnerability could let unauthenticated attackers log in as user ID 1 when the Automatically Log In setting is enabled.
Wordfence validated the report for CVE-2026-15748, confirmed the proof-of-concept exploit, and sent full disclosure details to the vendor. The flaw allows unauthenticated arbitrary file upload that can lead to remote code execution under certain configurations.
Wordfence received a bug bounty submission for CVE-2026-15748 affecting the Forminator Forms WordPress plugin. The finding was credited to the researcher daroo.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceheise.de
Open sourcethehackernews.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities were disclosed in widely used WordPress form plugins, exposing sites to unauthenticated attacks that can lead to full server compromise. **CVE-2026-4347** affects **MW WP Form** through version `5.1.0` and stems from insufficient file path validation in `generate_user_filepath` and `move_temp_file_to_upload_dir`. An attacker can move arbitrary files on the server without authentication, and if a sensitive file such as `wp-config.php` is relocated, the flaw can be leveraged for remote code execution. Exploitation requires a form with a file upload field and the **Saving inquiry data in database** option enabled; the issue is tracked as **CWE-22**.
Jun 29, 2026
A critical vulnerability in the WordPress plugin **Ninja Forms – File Uploads** has exposed more than **50,000 sites** to unauthenticated arbitrary file upload, with security researchers and CSIRT.SK reporting active exploitation in the wild. Tracked as `CVE-2026-0740`, the flaw affects versions **3.3.26 and earlier** and stems from insufficient validation of uploaded file types, file extensions, and file paths in `NF_FU_AJAX_Controllers_Uploads::handle_upload`, allowing attackers to upload malicious files, including PHP scripts. Successful exploitation can lead to **remote code execution** and full site compromise, giving attackers a path to persistent access and broader server takeover. Defenders are urged to update immediately to **version 3.3.27 or later** and review affected WordPress installations for unauthorized uploads or filesystem changes, as public reporting indicates the vulnerable plugin was deployed on tens of thousands of websites at the time of disclosure.
Jul 24, 2026
A critical vulnerability tracked as **CVE-2026-14894** affects the WordPress plugin **Super Forms – Drag & Drop Form Builder** in versions **up to and including 6.3.313**, allowing unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. The flaw stems from missing file-type validation in the plugin's `submit_form` function and the absence of a capability check on a `nopriv` AJAX handler; the required nonce can also be trivially obtained through the `super_create_nonce` `nopriv` AJAX action. The issue is classified as **CWE-434** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The maintainer released **Super Forms 6.3.314** to address the issue by hardening file-upload handling and preventing unauthorized file writes. The patch restricts PDF generation behavior, sanitizes filenames, verifies that uploaded content begins with a PDF header, and enforces safer path handling within the upload directory, closing an attack path that could be exploited in as few as two unauthenticated HTTP requests.
Jul 10, 2026