Somewhere out there, a WordPress site owner is filling out a contact form right now, blissfully unaware that their "Upload Your Resume" field just became a loading dock for malware. That's the magic of a CVSS 9.8 bug: it turns the most boring part of your website into the most dangerous.
A Blocklist That Blinked
Security researchers disclosed CVE-2026-15748, a critical flaw in Forminator Forms, the WordPress form builder plugin running on more than 600,000 active sites. The bug lets an unauthenticated attacker upload a malicious PHP file and achieve full remote code execution — no login, no social engineering, just a form.
The root cause is almost elegant in its pettiness: Forminator's dangerous-extension blocklist does exact-key matching, and attackers can slip past it using pipe-alternative MIME type keys, paired with a public submission handler that trusts attacker-controlled upload configuration smuggled in through a forged Select field. Any form combining a File Upload field with a Select field is fair game. Every version through 1.56.1 is affected; 1.56.2, released July 31, closes the hole.
Why "It's Just a Contact Form" Is Famous Last Words
Forms are the part of a website everyone treats as furniture — set it up once, forget it exists. That's exactly why they're such good attack surface: nobody's watching them, and a compromised form can hand an attacker a shell on your server, not just your inbox.
The one saving grace here is that WordPress's default .htaccess rules block PHP execution in the uploads directory — but only if you haven't customized your upload storage path, which plenty of agencies and page builders quietly do. Translation: "am I default enough to be safe" is not a sentence anyone should have to ask about their production website.
Patch it today, check your upload paths, and maybe stop letting a form plugin decide your server's fate.
If "when did we last audit our plugins" isn't a question you can answer off the top of your head, that's exactly the gap our free developer's security checklist was built to close — grab it here.
Source: The Hacker News