What happened
Security researchers publicly detailed a critical vulnerability in Forminator Forms, a WordPress form-builder plugin with more than 600,000 active installations. Tracked as CVE-2026-15748 and rated 9.8 out of 10, the flaw lets an unauthenticated attacker upload arbitrary files through a site's public form submission handler by forging the upload field configuration, bypassing the plugin's file-type blocklist. In the worst case, that means uploading executable PHP code and taking over the site. Exploitation requires a form that contains both a file-upload field and a select field, and default storage configurations blunt the attack on many sites, but researchers at Defiant who found the bug warned that certain common configurations allow full remote code execution. A patched version, 1.56.2, was released on July 31, yet SecurityWeek reported on August 18 that roughly 300,000 sites were still running vulnerable versions. No in-the-wild exploitation had been confirmed at disclosure, but WordPress plugin flaws of this severity are typically weaponized quickly once details go public.
Why it matters for your business
WordPress powers a huge share of small-business websites in the DC, Maryland, and Virginia market, and contact forms are one of the most common features on them. Forminator is exactly the kind of plugin an agency installed years ago that nobody has thought about since. A compromised site can be used to host malware, redirect your customers to scams, or send spam that lands your domain on blocklists, and cleanup usually costs far more than prevention.
What to do about it
- Log into your WordPress admin panel and check whether Forminator is installed
- If it is, update to version 1.56.2 or later immediately
- Turn on automatic updates for plugins, or ask whoever maintains your site to confirm they patch monthly
- Remove plugins you no longer use; every inactive plugin is attack surface