THREATOPS

THREAT OPS › Threat News › 600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin

600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin

medwordfencePublished 2026-08-17

<p>On July 14th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in <a href="https://wordpress.org/plugins/forminator/" rel="noopener" target="_blank">Forminator Forms</a>, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP fi

MITRE ATT&CK techniques

Malicious FileT1204.002
VulnerabilitiesT1588.006

Indicators of compromise

7965cd13376a540548ec7009cd66b05bmd5
CVE-2026-15748cve
https://wordpress.org/plugins/forminator/url
https://www.cve.org/CVERecord?id=CVE-2026-15748url
https://codex.wordpress.org/Plugin_API/Filter_Reference/upload_mimesurl
www.gravatar.comdomain

Original source: https://www.wordfence.com/blog/2026/08/600000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-forminator-forms-wordpress-plugin/