Somewhere out there, a small business owner is proudly staring at their brand-new "Contact Us" form, blissfully unaware that it might as well have a neon sign reading "Servers This Way." Turns out the plugin behind millions of those forms just got caught leaving the back door not just unlocked, but propped open with a webshell.
A 9.8-Rated Wake-Up Call
Security researchers disclosed CVE-2026-15748, a critical arbitrary file upload flaw in Forminator Forms, a WordPress plugin installed on more than 600,000 sites. Roughly 300,000 of those were still running a vulnerable version when the news broke. The bug scores a 9.8 out of 10 on the CVSS scale, which in security-speak translates to "please stop what you're doing and patch this now."
The flaw lives in the plugin's file upload handler: attackers can bypass the dangerous-file blocklist using a MIME-type trick, then forge a form field configuration to smuggle a PHP file onto the server. If the site has both a File Upload field and a Select field on any form, that's enough to hand an unauthenticated attacker a webshell, and from there, credentials, the database, and the whole site. The vendor patched it in version 1.56.2 on July 31, 2026, but a patch only helps sites that actually install it.
Why "Set It and Forget It" Plugins Are the Problem
Contact forms feel about as dangerous as a doormat, which is exactly why nobody checks on them. Businesses install a form plugin once, never think about it again, and meanwhile it's quietly become one of the most privileged pieces of code on the site, capable of writing files straight to the server.
The real lesson isn't "Forminator bad." It's that every plugin on your CMS is a standing liability that needs monitoring, not a one-time install. Today it's a form plugin; a few months ago it was something else entirely, and it'll be something else next quarter.
A form that lets strangers upload files to your server was always one bad validation check away from disaster, this is just the week the check failed.
If you're not sure which plugins on your Drupal or WordPress site are quietly holding the keys to your server, that's exactly the kind of audit we run at WTK, grab our free supply-chain security checklist to start checking your own.
Source: SecurityWeek