Urgent Security Alert: Critical Forminator Forms Vulnerability Poses RCE Risk to Over 600,000 WordPress Sites

In today's digital economy, a company's website is far more than just a digital storefront; it is a critical channel for customer engagement, lead generation, and data processing. However, a major security development this week has put hundreds of thousands of business websites at risk. A critical WordPress security vulnerability has been disclosed, highlighting the urgent need for business leaders to review their digital infrastructure and ensure their web assets are adequately protected against sophisticated cyber threats.

Executive summary

• A critical vulnerability tracked as CVE-2026-15748 (CVSS score 9.8/10) has been identified in Forminator Forms, a popular WordPress plugin with over 600,000 active installations.
• Unauthenticated remote attackers can exploit this flaw to upload malicious executable files, leading to Remote Code Execution (RCE) and complete site takeover.
• WordPress Core also released an urgent security update (version 7.0.4) to address another high-severity RCE vulnerability (CVE-2026-65640) involving image processing libraries.
• Organizations must take immediate action within the next 24 to 72 hours to audit their WordPress environments and apply necessary security patches.

What happened?

In mid-August 2026, cybersecurity research firms including Wordfence and Defiant published detailed advisories regarding CVE-2026-15748. This vulnerability affects all versions up to and including 1.56.1 of Forminator Forms, a widely used drag-and-drop form builder plugin developed by WPMU DEV. Rated 9.8 out of 10 on the CVSS scale, this flaw represents a worst-case scenario for web security: it requires no authentication, has low attack complexity, and can be exploited remotely over the network.

How the attack works at a high level

The vulnerability lies within the plugin's file upload handling mechanism (handlefileupload). While the plugin employs a blocklist to prevent dangerous file extensions (such as PHP) from being uploaded, this validation can be bypassed. Attackers can exploit a flaw in how the blocklist matches file extensions by using alternative MIME type structures. Furthermore, the public submission handler incorrectly trusts attacker-controlled upload configurations injected via forged form fields. When a form contains both a File Upload field and a Select field, an unauthenticated attacker can submit a crafted request that bypasses the file type checks, uploading a malicious PHP webshell. If the web server is configured to allow script execution within the upload directory, the attacker can execute arbitrary commands on the host server simply by requesting the uploaded file.

Why this is a business risk

For any business, a Remote Code Execution (RCE) vulnerability is a severe operational and financial threat. If an attacker successfully compromises your website, they gain full administrative control. This allows them to exfiltrate sensitive customer data, deface the website, inject malicious redirect scripts, or deploy ransomware to encrypt server files. Additionally, compromised sites are frequently used to host SEO spam or phishing pages, which can cause search engines like Google to blacklist your domain, destroying your brand's hard-earned digital reputation overnight. The cost of incident response, data recovery, legal compliance, and brand rehabilitation far outweighs the effort required to proactively secure the system.

Other notable enterprise risks this week

Beyond the Forminator plugin, several other critical security updates were released this week that demand immediate attention from IT infrastructure teams. WordPress Core issued version 7.0.4 to patch CVE-2026-65640 (CVSS 8.8), an authenticated RCE vulnerability triggered when processing images using Imagick and Ghostscript. In the enterprise networking space, CISA added CVE-2026-20349 (CVSS 8.6)—a high-severity Denial of Service vulnerability affecting Cisco Secure Firewall ASA and FTD devices—to its Known Exploited Vulnerabilities (KEV) catalog due to active in-the-wild exploitation. Additionally, a critical path traversal vulnerability in Broadcom VMware vCenter (CVE-2026-59310, CVSS 9.8) is also being actively targeted by threat actors to gain unauthorized access to internal corporate networks.

What businesses should do in the next 24–72 hours

• Audit all corporate WordPress sites to determine if the Forminator Forms plugin is installed.
• Immediately update the Forminator Forms plugin to version 1.56.2 or later to apply the official security patch.
• Upgrade WordPress Core to version 7.0.4 (or the corresponding patched version for older release branches) to mitigate the image processing vulnerability.
• Configure your web server (NGINX or Apache) to explicitly disable PHP execution within all upload directories.
• Review server access logs and upload directories for any unexpected PHP files or unusual form submission patterns.

Long-term lessons for CMS and digital infrastructure security

The security events of this week underscore a fundamental truth: digital security is an ongoing process, not a one-time setup. Relying on default configurations or reactive patching leaves businesses highly vulnerable to modern automated threat scanners. Organizations must establish a robust patch management policy that ensures all software—from CMS plugins to core operating systems and network firewalls—is updated promptly. Implementing a Web Application Firewall (WAF) and continuous monitoring solutions can block malicious traffic before it reaches vulnerable code. Finally, maintaining a secure, off-site, and regularly tested backup strategy is critical to ensuring business continuity and rapid recovery in the event of a successful compromise.

How Hanoi Byte can help

If your business relies on WordPress, a custom CMS, or cloud-based digital infrastructure, Hanoi Byte can help you assess risks, modernize your systems, and build a practical security and maintenance roadmap. As a trusted digital transformation partner, we specialize in custom software development, cloud optimization, and building secure, scalable digital operations tailored to your business needs. Contact Hanoi Byte today to start a conversation about making your digital operations more secure, scalable, and resilient.