Somewhere in the Forminator Forms codebase, a blocklist meant to stop people from uploading executable code got outsmarted by a single pipe character. That's it. That's the whole heist. No password guessing, no phishing email, no social engineering — just a MIME type spelled slightly differently than the filter expected.

A Blocklist That Blinked

Researchers disclosed CVE-2026-15748, a maximum-severity (CVSS 9.8) arbitrary file upload flaw in Forminator Forms, the WordPress form builder running on more than 600,000 sites. The plugin's file upload handler checks uploads against a list of dangerous extensions, but that check does exact-key matching — so an attacker can smuggle in a pipe-alternative MIME type expression that WordPress still reads as a .php file while the blocklist waves it right through.

Pair that trick with a forged form-field configuration on any page that has both a File Upload field and a Select field, and an unauthenticated attacker can drop a live PHP file straight onto the server. No login required. WPMU DEV patched the hole in version 1.56.2 on July 31, but by the time the flaw went public, an estimated 300,000+ sites were still running vulnerable code.

Why Your Contact Form Is Now a Threat Model

Contact forms feel like the most boring part of a website — right up until one becomes the on-ramp for a full server takeover. Once an attacker's PHP file executes, they're not stealing form submissions anymore; they're rewriting your homepage, planting a backdoor, or turning your server into infrastructure for the next attack.

The part that should really bug site owners: this wasn't some exotic zero-day nobody could have predicted. It's a validation function that trusted attacker-controlled input a little too much — exactly the kind of bug that turns up in a code review, if anyone's actually looking.

Half a million websites just found out their contact form had a trapdoor built in. Patch first, ask questions later.

If you're running WordPress or Drupal plugins nobody's audited since launch day, that's precisely the gap we go hunting for in a WTK security review — let's find it before someone else does.

Source: The Hacker News