Two Critical WordPress Plugin Vulnerabilities Could Lead to Full Site Takeover

Forminator Allows Unauthenticated PHP File Uploads

Two critical vulnerabilities have been reported in widely used WordPress plugins. The first affects Forminator Forms, installed on more than 600,000 sites, and is tracked as CVE-2026-15748.

The flaw has a CVSS score of 9.8/10.0 and affects all versions up to and including 1.56.1. It was fixed in version 1.56.2, released on July 31, 2026.

Discovered by the researcher known as “daroo,” the vulnerability allows unauthenticated attackers to upload arbitrary files through a public form. These files may include PHP scripts, potentially enabling remote code execution.

However, the site must contain a form with a specific combination of fields:

• a File Upload field;
• a Select field.

Without both elements, the described attack path does not appear to be exploitable.

How Upload Validation Can Be Bypassed

The flaw is located in the handle_file_upload() function, which processes file uploads. Its file-type validation does not robustly verify all values supplied by users.

The dangerous-extension blocklist relies on exact key matching. An attacker can bypass this check by supplying alternative MIME keys separated by pipe characters, causing the plugin to accept a file that should have been rejected.

The form’s public handler also relies on the upload field’s configuration. This configuration can be tampered with through a forged Select value, without requiring an account.

In practice, an attacker can submit the vulnerable form and place a specially crafted PHP file on the server. If the server interprets it as code, the attacker may execute commands with the privileges of the web process, modify site content, alter configuration, or create new administrative access.

The default configuration provides partial protection: files are normally stored in a directory containing an .htaccess file that prevents PHP execution. The risk increases when an administrator configures a custom upload storage root.

In this scenario, the .htaccess file may not be created correctly. The WordPress helper required to write the file is unavailable when the request is processed. A subsequent direct request to the uploaded file may therefore cause the web server to execute attacker-controlled PHP code.

User Profile Builder Allows Authentication as User 1

The second vulnerability affects User Profile Builder, installed on more than 40,000 sites, and is tracked as CVE-2026-15826.

The flaw has a CVSS score of 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It was fixed in version 3.16.5, released on July 16, 2026.

Information about the affected versions is not entirely consistent: one description identifies all earlier versions as vulnerable, while the available NVD entry lists versions up to and including 3.16.4. In either case, the recommended action is to upgrade to 3.16.5.

The flaw is an authentication bypass caused by type confusion in the wppb_log_in_user() function.

The Role of Long Usernames and absint()

Exploitation involves registering a username between 61 and 70 characters long. WordPress rejects the registration and returns a WP_Error object.

However, the plugin first applies absint() to the result of wp_insert_user() and only afterward checks whether the result is an error. This conversion forces the object to become the integer 1, preventing the is_wp_error() check from properly stopping the process.

The plugin consequently associates the request with an autologin nonce stored in a transient and linked to the user with ID 1. In a standard WordPress configuration, this account normally corresponds to the primary administrator.

The specific requirement is that the plugin’s Automatically Log In setting must be enabled. When this condition is met, an unauthenticated attacker can gain access as user 1, bypassing the normal authentication process.

The impact may include full administrative access, site modification, code installation, account manipulation, and complete takeover of the WordPress installation.

What Administrators Should Do

The priority is to update both plugins:

• Forminator Forms to version 1.56.2 or later;
• User Profile Builder to version 3.16.5 or later.

After updating, administrators should verify that no outdated copies, test installations, or secondary environments remain exposed to the Internet.

For Forminator, identify forms that combine File Upload and Select fields, then review the Custom File Upload Storage root configuration. It is also advisable to inspect recently uploaded files, focusing on unexpected PHP files, unusual extensions, and web requests directed straight to upload directories.

Logs may help identify:

• POST requests to public forms;
• uploads of PHP files or files with double extensions;
• subsequent access to newly uploaded files;
• unusual requests to custom storage directories.

For User Profile Builder, review the status of Automatically Log In and keep it disabled unless strictly required. Administrators should also check for new accounts, profile changes, access involving user ID 1, suspicious nonces, and recent changes to plugins, themes, and configuration.

For CVE-2026-15826, the reviewed data does not include information confirming its addition to the CISA KEV catalog, nor an inclusion date or deadline. For CVE-2026-15748, no KEV status, official NVD CVSS vector, or additional NVD metadata is currently available either.

The two vulnerabilities were disclosed on August 17, 2026. Both can be exploited without authentication and, when their respective prerequisites are met, may lead to complete site compromise.