Forminator RCE vulnerability: How the flaw works & fix

It’s surprising that a plugin used by more than 600,000 WordPress sites can let an attacker upload a PHP file without ever logging in. That’s the crux of the Forminator RCE vulnerability disclosed on August 17, 2026.

Key Takeaways

• CVSS score is 9.8 – a near‑critical rating.
• Exploit works only if a form has both a File Upload and a Select field.
• All versions up to 1.56.1 are vulnerable; patch arrived in 1.56.2 on July 31, 2026.
• Default uploads are blocked by an.htaccess file, but custom storage can bypass that protection.
• Wordfence flagged the issue and provided detailed technical analysis.

Forminator RCE vulnerability: technical breakdown

Wordfence says the problem lives in the handle_file_upload() function, where insufficient validation lets attackers slip a malicious MIME type past a blocklist that only checks exact keys. That’s why a crafted request can sneak a .php file into the upload directory.

How the arbitrary file upload works

When a form includes a Select field, an attacker can forge the field’s value to manipulate the upload handler. The blocklist looks for exact matches like “image/png”, but the attacker can present “image/png|application/php” – the pipe‑separated alternative bypasses the check. Then the public submission handler trusts the attacker‑controlled configuration and writes the file to disk.

“This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise,” Wordfence said in a report published today.

Because the upload routine creates the target file only when first needed, the.htaccess file that normally blocks PHP execution isn’t written. If the site admin has set a custom storage root, that directory may lack the protective.htaccess rule, letting the malicious PHP run on request.

In short, the exploit chain is: craft a request with a malicious MIME type, trick the Select field into passing a dangerous configuration, bypass the blocklist, and then request the uploaded file to trigger code execution. That’s all it takes to seize control of a WordPress site.

Patch timeline and version impact

Forminator’s maintainers released version 1.56.2 on July 31, 2026, which patches the faulty validation logic. All prior releases, including the widely used 1.56.1, remain vulnerable.

WordPress site owners should verify their plugin version immediately. If you’re still on 1.56.1 or earlier, you’re exposed to an attack that doesn’t require any authentication – that’s a huge risk.

Even if you’ve updated, you need to double‑check whether you’ve overridden the default upload directory with a custom path. The patch only fixes the validation; it doesn’t retroactively secure files already uploaded to an insecure location.

Real‑world exploitation scenarios

Consider a typical SaaS blog that lets contributors upload PDFs via a Forminator form. If the form also offers a category selector (a Select field), an attacker could submit a request that tags the upload as a PDF but actually carries a PHP payload.

• Step 1: Send a multipart POST containing a file named shell.php with MIME type application/pdf|application/php.
• Step 2: Forge the Select field value to trick the handler into accepting the MIME type.
• Step 3: The server stores shell.php in the custom upload folder without a protective.htaccess.
• Step 4: Request /uploads/shell.php and the server executes the attacker’s code.

That chain can be completed in seconds, and the attacker gains the same privileges as the web server user – typically enough to install backdoors, modify content, or dump databases.

Comparative context: other WordPress plugin bugs

Just days earlier, Wordfence highlighted a separate critical issue in the User Profile Builder plugin (CVE‑2026‑15826). That flaw let unauthenticated attackers log in as user ID 1 when the “Automatically Log In” setting was enabled. Both vulnerabilities share a common theme: they exploit mis‑configurations that developers assume are safe.

While the User Profile Builder bug required a specific setting to be turned on, the Forminator issue only needs a form with a File Upload and a Select field – a far more common scenario. That’s why the Forminator flaw feels especially alarming.

Both patches were released in July 2026, underscoring a busy month for WordPress security. It’s a reminder that plugin supply chains can hide high‑severity bugs that linger for months.

Mitigation steps for developers

If you run a site with Forminator installed, here’s what you should do right now:

• Update to 1.56.2 or later immediately.
• Audit any forms that combine File Upload and Select fields – consider removing the Select field or restricting allowed file types.
• Check custom upload directories for an.htaccess file that denies PHP execution; add one if it’s missing.
• Monitor server logs for unexpected POST requests with unusual MIME types.
• Run a scan with Wordfence or a similar security plugin to detect any previously uploaded malicious files.

Those steps won’t guarantee you’re safe forever, but they’ll dramatically cut the attack surface.

Historical Context

Forminator entered the WordPress ecosystem as a free form‑builder that quickly gained traction because it offered drag‑and‑drop design, conditional logic, and built‑in payment integration. By the time the vulnerability was disclosed, more than 600,000 sites relied on it for contact forms, surveys, and user‑generated content.

Earlier releases added the File Upload field in response to demand from e‑commerce and membership sites. The Select field, meanwhile, became a staple for categorization and dynamic pricing. When those two widgets were combined, developers assumed the built‑in validation would be sufficient.

That assumption proved fragile. The blocklist approach—checking MIME types against a hard‑coded list—had been sufficient for simple image uploads but never evolved to address composite MIME strings. The oversight persisted across multiple minor releases, slipping through automated testing because the edge case required a very specific request shape.

Wordfence’s disclosure on August 17, 2026 broke the silence that had surrounded the issue. The report provided the first public proof‑of‑concept, prompting the maintainers to issue the emergency patch less than a month later. The rapid response highlights how the WordPress community can rally when a high‑impact flaw surfaces.

What This Means For You

For developers, the takeaway is that reliance on a blocklist is fragile. If you’re building a WordPress site that accepts uploads, you need to enforce a whitelist of allowed extensions and MIME types, and you should never trust user‑controlled configuration values.

For site owners, the practical impact is immediate: an unpatched Forminator installation can be compromised without any credentials. That means loss of data, SEO penalties, and possibly legal liability if user data is exposed. Updating the plugin and tightening upload controls should be at the top of your security checklist.

To illustrate the risk, consider three concrete scenarios:

• Corporate intranet portal. Employees submit expense receipts via a Forminator form that also asks for the department (a Select field). An attacker could upload a PHP script disguised as a receipt, then execute it to harvest internal credentials.
• Educational site with student submissions. A course page uses a Forminator form for PDF assignments and includes a dropdown for assignment type. By injecting a malicious MIME string, a malicious student could gain admin‑level access to the learning management system.
• Public-facing event registration. Organizers collect speaker bios and headshots, storing files in a custom “speakers” directory. If that directory lacks an.htaccess rule, a crafted upload could turn the site into a command‑and‑control node.

Each scenario shares a common thread: a legitimate workflow that mixes file uploads with a selection widget. The vulnerability turns that convenience into an open door.

What happens next will depend on how quickly the WordPress community adopts the fix and whether attackers start weaponizing the technique in the wild. Will we see a surge of compromised sites, or will the patch hold the line?

Key Questions Remaining

Even after the patch, several open questions merit attention:

• How many sites have already uploaded malicious files to custom directories before the fix?
• Will WordPress core introduce a unified upload sanitization API to replace plugin‑specific blocklists?
• Can security plugins automatically remediate existing rogue files, or must site owners intervene manually?
• What monitoring practices will become standard to detect the specific MIME‑type abuse pattern?

Answers will shape future hardening guidelines. Until then, vigilance remains the best defense.

Sources: The Hacker News, original report