A critical Forminator Forms flaw could let hackers take over vulnerable WordPress sites. Here’s who may be affected, what website owners should check, and how to protect your site today.
Table of Contents
What Happened With the WordPress Forminator Flaw?
According to SecurityWeek, a critical flaw was found in the Forminator Forms plugin for WordPress.
Forminator is a tool website owners use to create contact forms, surveys, quizzes, and other online forms. The flaw is tracked as CVE-2026-15748 and has a severity score of 9.8 out of 10. It could allow an attacker to upload an executable file without logging into the website. An executable file contains instructions that can run on a server.
In some configurations, that could allow criminals to run their own code and take control of the website. The flaw affects Forminator versions 1.56.1 and earlier. It was fixed in version 1.56.2, released on July 31.
Forminator has more than 600,000 installations. WordPress data indicates that roughly half are still using a vulnerable version. That means more than 300,000 WordPress websites could still need the security update.
Security researchers said there were no reports of criminals actively exploiting the flaw when the report was published.
Even though no data breach has been confirmed in this case, website attacks can sometimes lead to personal information being stolen later. And your data may already have been leaked through other breaches without you knowing.
If you are not sure whether your information has appeared in a known data breach, automatic monitoring can help you spot problems earlier.
Futureproof monitors your data for leaks 24/7 and helps you reduce scam risks with simple, clear steps.
Who Is Affected and Was Any Data Leaked?
The problem affects websites using Forminator Forms version 1.56.1 or earlier.
However, the report does not say that personal information was stolen or leaked. There is also no confirmed data breach linked to this vulnerability.
That distinction matters. A vulnerable website does not automatically mean your personal information has been stolen.
Still, personal information can be leaked through many unrelated breaches, and people often do not realize their data was affected.
Futureproof scans your data for leaks and shows exactly how to close security gaps — before scammers find them first.
Check my safetyHow Hackers Could Use the Forminator Vulnerability
The problem comes from the way Forminator checks files submitted through its forms.
Normally, a website should block dangerous file types before accepting an upload. However, researchers found a way to bypass some of those checks.
An attacker could create a specially prepared form submission and upload an executable file without having a WordPress account.
What happens next depends on how the website stores uploaded files.
By default, Forminator places files in a protected folder that prevents PHP files from running. PHP is a common programming language used by WordPress.
However, websites using a Custom File Upload Storage location may not have the same protection.
In that situation, an attacker could request the uploaded file and make its code run on the website.
Researchers warned that criminals could then use tools called webshells. A webshell is a hidden file that lets an attacker control a website remotely.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
