Overview of the Vulnerability
A critical security flaw (CVE-2026-15748) has been disclosed in Forminator Forms, a widely used WordPress plugin with over 600,000 active installations. The vulnerability carries a CVSS severity score of 9.8 out of 10.0 and enables unauthenticated remote code execution (RCE), allowing attackers to upload and execute arbitrary PHP code on vulnerable installations.
Forminator Forms is developed by WPMU DEV and is listed on the WordPress plugin repository. It provides a flexible form-building interface for WordPress users and supports various field types, email notifications, and integrations.
CVE Details and Technical Context
CVE-2026-15748 is a deserialization-based vulnerability stemming from improper validation of user input during file upload handling. According to the advisory, the flaw arises from the plugin’s handling of serialized data in form submission metadata, specifically within the forminator_csp_report_submit AJAX endpoint. This endpoint does not verify user authentication before processing the request.
“The vulnerability allows an attacker to inject malicious serialized PHP objects that, when unserialized, can trigger arbitrary code execution via PHP’s magic methods.” — Security researcher advisory, 2026
The vulnerability is particularly dangerous because it does not require any authentication or user interaction. An unauthenticated request to /wp-admin/admin-ajax.php with a specially crafted payload can lead to complete compromise of the WordPress installation, including data theft, malware deployment, or using the site as a launchpad for further attacks.
Attack Vector and Exploitation Conditions
Exploitation requires the target site to be running a vulnerable version of Forminator Forms. WPMU DEV has confirmed the following affected versions:
- Versions before 1.19.2 (inclusive)
The attack does not require any special permissions and can be executed remotely using a single HTTP POST request. The malicious payload typically involves crafting a serialized object that abuses PHP’s autoloading mechanism to instantiate classes whose destructors or wakeup methods execute dangerous operations.
The following is a representative attack structure observed in proof-of-concept demonstrations:
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded
action=forminator_csp_report_submit&data=a:1:{s:10:"some_field";O:28:"some_vulnerable_class":1:{s:12:"some_property";s:XX:"payload.php";}}The exact class name and structure depend on the plugin’s codebase, but the vulnerability stems from insecure deserialization practices.
Patch and Mitigation Status
WPMU DEV has released a patched version, Forminator Forms 1.19.2, which addresses the deserialization flaw. Site administrators are urged to upgrade immediately. No known workarounds exist for unpatched installations.
“Upgrading to version 1.19.2 eliminates the vulnerable code path and enforces strict validation and sanitization of all user-supplied data before deserialization.” — WPMU DEV security team
The patch includes:
- Removal of the unsafe
forminator_csp_report_submitdeserialization logic - Enhanced input validation on all AJAX entry points
- Explicit denial of unauthenticated access to sensitive endpoints
Third-Party and Industry Response
The vulnerability was initially disclosed responsibly to WPMU DEV on an undisclosed date in early 2026. After coordination and patch development, a public advisory was released on August 14, 2026. Security researchers have since confirmed active exploitation attempts in the wild, though no widespread campaign has been verified as of this report.
Independent researchers have verified the exploitability of the flaw in test environments and urge immediate patching across all Forminator users. The WordPress Security Team has added Forminator Forms to its list of plugins under active vulnerability monitoring.
Recommendations for Administrators
All WordPress administrators running Forminator Forms are advised to take the following actions immediately:
- Upgrade to Forminator Forms version 1.19.2 or later
- Audit server logs for suspicious AJAX requests to
admin-ajax.phpreferencingforminator_csp_report_submit - Scan uploaded files and database entries for unexpected serialized objects or PHP shells
- Review all installed plugins for out-of-date dependencies
Organizations using managed WordPress hosting should contact their provider to confirm patch deployment timelines and verify system integrity.
Broader Implications
This incident underscores the persistent risk posed by insecure deserialization in PHP applications. Even well-established plugins with large install bases can contain critical logic flaws if serialization is used without strict type and source validation. Developers are reminded to avoid unserialize() with user-supplied input or, if unavoidable, to implement strict object whitelisting and runtime monitoring.
The 9.8 CVSS score reflects the combination of low attack complexity, no required privileges, and complete impact on confidentiality, integrity, and availability. In many deployments, compromise via this flaw would allow attackers to escalate privileges, steal credentials stored in WordPress options, or deface sites for censorship or ideological purposes.