A vulnerability was found in the Forminator plug-in on the Wordpress website.

A vulnerability was found in the Forminator plug-in on the Wordpress website, allowing for easy RCE by simply uploading a PHP file.

According to a report by The Hacker News website, a security vulnerability has been detected on a Wordpress plugin called Forminator Forms, a plugin for creating and administering forms on a very popular website. There are more than 6 lakh websites installed. A research team from Wordfence, a security plugin developer on the Wordpress website, says the vulnerability detected is coded CVE-2026-15748, a vulnerability with a danger rating, or CVSS Score, of 9.8 points out of 10, which is called a very serious vulnerability because it opens up a channel for users to use. Upload any file to the website, including an Executable PHP file, which can hack or release malware to the website.

The condition for using this vulnerability is that the form must have a file upload field and a Select Field on the form. The reason why these two fields can be used to upload dangerous files to the site is that Wordpress has revealed that there is a problem in the "handle _ file _ upload ()" function of the plug-in that cannot verify the file type Validation uploaded by the user.

This vulnerability is located on all Forminator Forms versions 1.56.1 and below. Those who are using it can plug it by upgrading it to version 1.56.2 via a patch released for download on July 31. Therefore, ask the person who is currently using this plug-in to check the version and update it immediately.

# Trending # lemon 8 diary # forminator # Wordpress # freedomhack