vulnerability
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Critical
Summary
A critical security flaw in Forminator Forms (WordPress plugin) and User Profile Builder (WordPress plugin) allows unauthenticated attackers to execute arbitrary code on vulnerable sites. The Forminator vulnerability (CVE-2026-15748) stems from a lack of file type validation, while the User Profile Builder vulnerability (CVE-2026-15826) involves an authentication bypass. Both plugins have been patched, and users are urged to update immediately.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data