Published Aug 17, 2026, 2:22 PM ET · Updated 3 months ago · 1 source
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
The Hacker News
·
Original Report
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "