If you received an email from me pointing you to this page, it is because your website appears to be running a version of Forminator Forms (the WordPress plugin by WPMU DEV, which lives in your files at /wp-content/plugins/forminator/) that falls within the affected range of a known security issue. This page explains what the issue is, how to work out whether it applies to your site at all, how to read your version without being misled, and how to update.

Before anything else, the most important fact about this notice: a version in the affected range does not by itself mean your site is exposed. The issue below only comes into play on sites whose forms include a file-upload field, and I cannot see how your forms are built from outside:

  • The issue only reaches a Forminator form that contains a file-upload field. If none of your forms let visitors upload files, this does not affect you, even on an affected version.
  • Note that it is the presence of an upload field that matters, not how it is configured. Restricting a field to specific types (for example images or PDFs) does not close this, because the flaw defeats that restriction. What takes you out of range is having no form with a file-upload field at all.

I can read your plugin version from a public file, but I cannot read your forms, so this notice is a precautionary heads-up rather than a confirmed finding about your site.

The issue is CVE-2026-15748, an unauthenticated file-upload flaw in the plugin’s form handling. It affects versions 1.18.1 through 1.56.1 and is fixed in 1.56.2, released on 30 July 2026. If you are running an affected version, update Forminator Forms to 1.56.2 or later (the current release at the time of writing is in the 1.57.x line).

A word on urgency, because this is a conditional notice. If none of your forms has a file-upload field, updating is ordinary plugin maintenance. If one of them does, please treat the update as a priority: in that configuration the flaw could let a visitor with no account at all save a file of their choosing onto your server, of a kind that the server might then run, which can lead to full control of the site.

This is a plugin flaw, not a WordPress core flaw. A fully up-to-date WordPress does not protect you if the Forminator plugin itself is on an affected version.

Is this message legitimate?

Yes. This is a good-faith, responsible-disclosure notice from an independent security researcher. I am not asking you for money, passwords, or access to your site, and I have not attempted to break into it, submit any of your forms, or upload anything to it.

All I did was look at publicly visible files that your website serves to every visitor (the same way your homepage is public) and note the version number that the plugin publishes. I specifically did not submit any form, did not upload a file, and did not go near the plugin’s upload handler. Nothing about this check touches your data, your admin area, or any private part of your site (more detail under What I did and did not do below).

If you would like to verify who I am, see the contact details at the bottom of this page and the About page.

Why this matters

Forminator lets you build contact forms, quizzes, polls and payment forms, and some of those forms can offer visitors a file-upload field so they can attach a document or an image. To keep that safe, the plugin is supposed to control which files it will accept and where it stores them.

In affected versions, those controls could be slipped past. A crafted form submission could smuggle a forged field value through the part of the plugin that saves an entry, and from there into the file-saving routine, whose list of banned file types could be bypassed with a specially shaped request. The result is that a file the plugin should have refused could be written into your uploads directory. Where the server then treats that file as something it can run, a stranger’s file runs on your site.

Two things follow from that, and they pull in opposite directions. The first is that this only matters where a form actually has a file-upload field; a site whose forms collect no uploads is not reachable through this issue. The second is that where such a field does exist, no account, no password, and no cooperation from anyone is required: the form is open to the public by design. And here is the part most likely to be misread: restricting that field to “images only” or “PDFs only” does not save you, because the flaw defeats the field’s own type check. The question is simply whether a file-upload field exists on any of your forms.

I am describing this at the level a site owner needs in order to act, and no further. I am not publishing the details that would let someone reproduce it, and I would ask you not to try it against your own site or anyone else’s. Checking your forms and your version, as described below, tells you everything you need to decide what to do.

If my email cited this issue, it means the version your site reports falls within the affected range. I did not test whether your particular site is exploitable, and I cannot see how your forms are built. All I observed is the version.

Am I affected?

Two questions decide it, in this order.

First: does any form have a file-upload field?

This is the deciding question, and only you can answer it. Checking your own forms is entirely safe and is the whole point of this page.

  1. Log in to your WordPress dashboard and open Forminator in the sidebar, then Forms.
  2. Open each form and look for an Upload field (Forminator’s file-upload field type).
  3. If none of your forms has an upload field, this issue does not reach your site, even on an affected version, though updating is still worth doing as ordinary maintenance.
  4. If any form has an upload field, the issue applies to you and you should update promptly. Restricting the field to the file types you actually need is good practice, but it is not a fix for this issue: the update is the fix.

Please do not try to reproduce the problem against your own site or anyone else’s; you do not need to in order to answer the question above.

Second: which version are you running?

You do not have to take my word for it. For this plugin there are a couple of ways of checking that will mislead you, so it is worth reading this part carefully.

From the WordPress admin area (authoritative):

  1. In your WordPress dashboard, go to Plugins then Installed Plugins.
  2. Find Forminator Forms, the entry whose folder is forminator, and note the version shown beneath its name.

From your page source (no login needed): view the source of a page on your site that displays a Forminator form, and look for one of the plugin’s front-end assets at exactly these paths:

/wp-content/plugins/forminator/build/front/front.multi.min.js?ver=...
/wp-content/plugins/forminator/assets/forminator-ui/js/forminator-form.min.js?ver=...
/wp-content/plugins/forminator/assets/forminator-ui/css/forminator-icons.min.css?ver=...

The ?ver= number attached to those files under the forminator folder is the plugin’s own version. For this plugin it tracks the release, which is why I treat it as a dependable reading. Note that the assets only appear on a page that actually renders a Forminator form, so check a page that has one (a bare homepage with no form on it often shows nothing).

Two traps to avoid here. Both make a naive read report a version that has nothing to do with Forminator:

  • The bundled phone-number library. Forminator ships a copy of a third-party library called intlTelInput, which carries its own version number, 4.0.3. Depending on your version it rides either the file assets/css/intlTelInput.min.css or assets/js/library/intlTelInput.min.js, both inside the Forminator folder. If you read a ?ver=4.0.3 off one of those, that is the library’s version, not Forminator’s. Forminator has never had a 4.x release. Read only the files listed above, and treat any version that does not start with 1. as “not the Forminator version”.
  • The per-form stylesheet under your uploads folder. Forminator writes a small stylesheet for each published form at a path like /wp-content/uploads/forminator/<something>/style-<number>.css?ver=<a long 10-digit number>. That long number is a timestamp, not a version. It sits under wp-content/uploads/, not under the plugin folder, so ignore it entirely.

One more note specific to this plugin: its bundled readme.txt “Stable tag” line is not reliable here, since it can lag the real release (both the 1.56.1 and the 1.56.2 build report 1.56.0), so unlike some plugins, that file will not tell you which of those two you have. The admin screen and the asset ?ver= above are the reads to trust.

Then apply this rule, noting that versions compare numerically, not alphabetically:

  • 1.18.1 through 1.56.1: potentially affected, subject to the upload-field question above. Update now.
  • 1.56.2 or newer: already fixed as far as this issue is concerned. Taking the latest available version (the 1.57.x line at the time of writing) is the best move.
  • Older than 1.18.1: not affected by this issue. The specific weakness described above was introduced at 1.18.1. That said, a release that old is far behind on everything else, and updating is worth doing on general grounds.

If you cannot get a readable version out of the checks above, that is not unusual: caching or optimisation plugins routinely strip the ?ver= value, and the assets only appear where a form renders. The admin screen in the first check always has the answer.

How to upgrade

The plugin is free, still published, and actively maintained, so the fix is a normal update. The safest path is to update through WordPress itself, and to back up first:

  1. Back up your site (files and database) before making changes. Most hosting providers offer one-click backups, or use a WordPress backup plugin.
  2. In the WordPress admin, go to Dashboard then Updates, or Plugins then Installed Plugins. If a Forminator update is listed, install it from here.
  3. If you prefer the command line, WP-CLI does the same thing: wp plugin update forminator (the command uses the folder name).
  4. If no update appears, you can get the latest release directly from the plugin’s page on the WordPress.org directory, Forminator Forms, and update via Plugins then Add New Plugin then Upload Plugin.
  5. After updating, confirm the new version number (1.56.2 or later) using the steps above, and check that your forms and any file uploads on them still work normally.

While you are in there, it is worth confirming that WordPress core and your other plugins are up to date, since the same principle applies to all of them.

After updating

Updating to 1.56.2 or later closes the issue, and for most sites that is the whole task. This page is a precautionary notice, not an incident report: I have no visibility into whether anything happened on your site, and I did not look.

One follow-up is worth considering, and it is conditional on the same upload-field question. If your site had a form with a file-upload field while running an affected version, then it was at least theoretically possible for a file to have been placed on your server. Updating closes the hole, but it does not remove anything that may already have been saved, so in that case a few routine precautions are sensible:

  • Look through your uploads directory (typically under wp-content/uploads/, including the wp-content/uploads/forminator/ subtree) for files you do not recognise, especially any that are not the kind of documents or images your forms are meant to receive.
  • Review your administrator accounts, recent logins, and any active sessions for anything you cannot account for.
  • Reset the passwords on your administrator accounts. Regenerating WordPress’s secret keys and salts in wp-config.php is a sensible companion step (new values are one click away at the official secret-key generator, and swapping them signs every user out once).

If you find something that concerns you, treating it as you would any other suspected unauthorized access is the right response. If none of your forms had a file-upload field, updating alone is enough.

What I did and did not do

To be fully transparent about the check behind my email: I only read files that your site already serves to every visitor, specifically the plugin’s public readme.txt, your homepage, and the asset addresses written into that page. I did not access your WordPress admin area, your database, or any private part of the site.

In particular, I never submitted any of your forms, never uploaded a file, and never touched the plugin’s upload handler. Nothing was submitted, tested, or exploited. That matters more here than on most of these pages, because uploading a file is the exact action this issue concerns, so “I did not touch it” is the whole difference between a disclosure and an intrusion.

I am also deliberately not publishing the details that would help someone act on this issue. The description above stops at the level a site owner needs, and I do not link any proof-of-concept code.

This is a version-based observation: your site reports a version in the affected range. It is not a statement that your site was exploitable at the time I checked. Because the issue depends on whether any of your forms has a file-upload field, which I cannot see, a site in that range may well not be exposed at all, and a site in that range may separately be protected by other means such as a web application firewall.

I do not have a webmaster / I am stuck

If you are not the person who maintains the site, please forward this page to whoever does (your web developer, agency, or hosting provider). They will recognize the steps above quickly.

If you are maintaining the site yourself and get stuck, I am happy to help point you in the right direction at no cost. Reach out using the contact details below.

Contact

Evan Harris, Security Researcher

I reach out about issues like this purely to help operators secure their sites. If you would prefer not to be contacted again, just let me know and I will honor that.

References

Official advisories and tracking

Vendor / plugin