Forminator's 9.8 upload bug was fixed on July 31. The hard part is knowing you run it

Wordfence has disclosed CVE-2026-15748, an arbitrary file upload flaw rated 9.8 out of 10 on CVSS in Forminator Forms, a WordPress plugin with more than 600,000 active installations ^[1][2]. The fix, version 1.56.2, has been available since July 31, 2026, which makes anything still exposed a records problem rather than a patching one ^[3].

The bug sits in the plugin's handle_file_upload() function and stems from insufficient validation of user-supplied file types ^[4]. According to Wordfence, the dangerous-extension blocklist performs exact-key matching that can be bypassed with pipe-alternative MIME type keys, while a public submission handler trusts upload field configuration that an attacker injects through a forged Select field value ^[5]. The consequence, in Wordfence's description, is that unauthenticated attackers can upload arbitrary files including executable PHP, leading to remote code execution and complete site compromise ^[6]. The flaw was reported by a researcher using the alias "daroo" ^[7]. Every version up to and including 1.56.1 is affected ^[8].

The 600,000 number is an install count, not a count of exploitable sites, and the gap between the two is where the work is. Exploitation requires a form that contains both a File Upload field and a Select field ^[9]. In the default configuration, uploads go to a directory protected by an .htaccess file that prevents PHP execution ^[10]. The dangerous case is a site where an administrator configured a Custom File Upload Storage root: Wordfence says the .htaccess file there is created only when it is first needed, during a frontend request in which the WordPress helper responsible for writing it is not loaded ^[11]. On that kind of site, simply requesting the uploaded file is enough to make the web server execute the attacker's PHP ^[12].

That is three conditions deep, and each one was set by someone building a contact form, not by someone maintaining an asset register.

The same week brought a second 9.8 in the same shape. Wordfence flagged CVE-2026-15826, an authentication bypass in User Profile Builder, which has more than 40,000 active installations, patched on July 16, 2026 in version 3.16.5 ^[13][14]. It is only exploitable where the plugin's Automatically Log In setting is enabled ^[15]. Wordfence attributes it to wppb_log_in_user() calling absint() on the return value of wp_insert_user() before the is_wp_error() check: a registration with a 61 to 70 character username is rejected by WordPress core with a WP_Error object, absint() coerces that to the integer 1, and the plugin binds and returns a transient-backed autologin nonce tied to user ID 1 ^[16]. That yields unauthenticated login as the administrator account and full site takeover ^[17].

Two patches, fifteen days apart, covering more than 640,000 installations between them ^[18][19]. Neither disclosure, as reported, describes exploitation in the wild; the vendor guidance is to update both plugins and verify installations are current ^[20].

What to watch: in both cases the deciding factor is a configuration choice, not plugin presence ^[21]. The useful artifact is a list of which sites run Forminator with a File Upload and Select field on the same form, and which of those point at a custom storage root. Without it, the answer to whether an estate is exposed is a guess dressed up as a version number.