Nobody thinks about their contact form plugin. It just sits there, quietly collecting "please call me back" messages, asking for nothing but your gratitude. Turns out one of the most popular ones was also quietly willing to let a stranger upload a webshell and take over your entire site.
The Upload Filter That Wasn't
Security researchers disclosed CVE-2026-15748, a critical flaw (CVSS 9.8) in Forminator Forms, a WordPress plugin installed on more than 600,000 sites. The bug lives in the plugin's handle_file_upload function, where insufficient file type validation let unauthenticated attackers forge field configurations and bypass the plugin's blocklist of dangerous file types entirely — clearing a path to upload executable files and achieve full remote code execution.
The flaw affects every Forminator Forms version up to 1.56.1 and was patched in version 1.56.2, released July 31. The catch: roughly half of all installs are still running a vulnerable version, which puts an estimated 300,000 WordPress sites potentially exposed to complete compromise via webshells, especially on sites with custom file upload storage configured.
Why "No Exploitation Yet" Isn't Comfort
At the time of disclosure, researchers hadn't spotted active exploitation in the wild. That is not the relief it sounds like. File-upload vulnerabilities with a CVSS score north of 9 are exactly the kind of bug that mass-scanning bots go hunting for the moment a public writeup exists — the gap between "disclosed" and "exploited at scale" is usually measured in hours, not weeks.
The bigger pattern here matters more than any single plugin: WordPress accounted for the overwhelming majority of CMS-related vulnerability disclosures this year, and it's consistently the plugin ecosystem — not WordPress core — doing the damage. Your site's actual attack surface isn't the platform you chose; it's the pile of third-party plugins nobody's audited since the day they were installed.
An unpatched form plugin isn't a minor housekeeping item — it's a welcome mat with a CVSS score attached.
If you're not sure which plugins on your site are quietly aging into liabilities, grab WTK's free security checklist for defending against supply-chain attacks — it's built for exactly this kind of blind spot.
Source: SecurityWeek