Loading vulnerability…
CVE-2026-15748 is a critical unauthenticated arbitrary file upload vulnerability in the Forminator Forms plugin for WordPress affecting all versions up to and including 1.56.1. The flaw is rooted in insufficient file type validation in the plugin's upload handling logic, specifically in the handle_file_upload() path, and can be reached through a chain of trust and validation weaknesses in frontend form processing. A crafted submission can abuse a Select field to inject attacker-controlled upload field metadata that is later treated as a legitimate upload configuration. During upload processing, the plugin trusts attacker-supplied field settings, including custom file type parameters, and its dangerous-extension filtering relies on exact-key matching that can be bypassed with alternative MIME-type patterns. This allows an unauthenticated attacker to upload executable PHP content to a vulnerable site. In deployments where uploaded files are stored in a location that permits script execution, the issue can be escalated to remote code execution and full site compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical arbitrary file upload vulnerability in the Forminator Forms WordPress plugin that can allow unauthenticated attackers to upload executable PHP files and achieve remote code execution on vulnerable sites.
An unauthenticated arbitrary file upload vulnerability in the Forminator Forms WordPress plugin that can lead to remote code execution by allowing attackers to upload executable PHP files through forged upload field configuration and insufficient file type validation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.