Security1 hOctober 17, 2026, 08:56

Critical Forminator flaw enables RCE on 600,000 WordPress sites

Forminator Forms for WordPress (versions 1.56.1 and earlier) contains CVE-2026-15748, rated CVSS 9.8. An unauthenticated attacker can override upload field settings via a Select field and bypass the dangerous-extension blocklist by appending a pipe character to the MIME type. The flaw is fixed in version 1.56.2.

DEV Community

Open source

Critical Forminator flaw enables RCE on 600,000 WordPress sites

CVSS 9.8: unauthenticated remote code execution
Affects versions 1.56.1 and earlier, fixed in 1.56.2
Over 600,000 WordPress sites run the plugin
Blocklist bypassed with a single pipe character

#WordPress#Forminator#Wordfence

Wordfence blocks 440,000 attacks on WordPress plugin RCE flaws

Security

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

Security

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites

Security

Critical Forminator flaw enables RCE on 600,000 WordPress sites

Wordfence blocks 440,000 attacks on WordPress plugin RCE flaws

Critical Ghostscript flaw lets attackers hijack servers via PDF uploads

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites

WordPress Patches Critical Flaw Enabling Code Execution on Some Servers