Critical Unauthenticated RCE Vulnerability Discovered in Forminator Forms WordPress Plugin

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. According to reports, the flaw was discovered and reported by a security researcher. The vulnerability enables unauthenticated remote code execution through malicious PHP file uploads, allowing attackers to upload and execute arbitrary code on affected WordPress sites. The exact exploitation methodology and confirmation of active exploitation in the wild remain unverified. WordPress site administrators using Forminator Forms are advised to monitor official advisories and apply patches as they become available. The vulnerability highlights the risks associated with file upload functionality in WordPress plugins and the importance of maintaining up-to-date software.