This WordPress Plugin Flaw Could Let Hackers Take Over Your Site

Robert Moore · 2026-08-17

If you're running a WordPress site, you probably have a handful of plugins you rely on daily. Forms, in particular, are one of those tools you set up once and forget about. But a newly disclosed vulnerability in Forminator Forms, a plugin with over 600,000 active installations, should make you sit up and pay attention. A critical security flaw has been uncovered that could allow an unauthenticated attacker to upload malicious PHP files and execute arbitrary code on your server. That's not just a minor inconvenience—it's a direct path to full site takeover, data theft, or worse. ### What's the Problem? The vulnerability, tracked as CVE-2026-15748, carries a CVSS score of 9.8 out of 10. That's about as severe as it gets. For context, anything above 9.0 is considered critical and typically means remote code execution (RCE) is possible without any authentication. The flaw was discovered and reported by a security researcher who goes by the online alias "Nexus." The researcher found that the plugin fails to properly validate file uploads submitted through its forms. In practical terms, a hacker could craft a request that tricks the plugin into accepting a PHP file disguised as something benign, like an image or a document. Once that file lands on your server, the attacker can execute it. That opens the door to installing backdoors, stealing user data, defacing your site, or even using your server as a launchpad for attacks on other targets. ### Who's Affected? If you use Forminator Forms on any WordPress site, you're potentially at risk. The plugin is widely popular because it's free, feature-rich, and integrates smoothly with popular page builders and email marketing tools. That popularity is exactly what makes this vulnerability so dangerous. Here's what you should know: - The flaw affects all versions of the plugin released before the latest security patch - Attackers don't need a user account or any special privileges to exploit it - Sites running outdated versions are especially vulnerable right now If you're not sure which version you're running, check your WordPress dashboard under Plugins. The fix was included in version 1.38.4, so anything older than that needs immediate attention. ### What Should You Do Right Now? First, update the plugin. This isn't a "maybe later" kind of situation. The exploit details are already public, which means attackers are actively scanning for vulnerable sites. Here's a quick action plan: 1. Log into your WordPress admin panel and navigate to the Plugins section 2. Look for Forminator Forms and check the version number 3. If it's below 1.38.4, click "Update Now" immediately 4. After updating, verify the plugin version has changed in your plugins list 5. Consider enabling automatic updates for this plugin going forward Beyond the immediate patch, it's worth auditing your site for any signs of compromise. Look for unexpected admin users, unfamiliar files in your uploads directory, or suspicious activity in your server logs. If anything looks off, change your passwords and consider working with a security professional. ### Why This Matters Beyond the Patch This vulnerability is a reminder that every plugin on your site is a potential entry point. Even well-maintained plugins can have flaws, and the ones with hundreds of thousands of users become prime targets for attackers. A good rule of thumb is to only keep the plugins you actually use, update everything regularly, and remove anything that's no longer maintained. The fewer moving parts you have, the smaller your attack surface. Also, consider implementing a web application firewall (WAF) if you haven't already. A WAF can block malicious requests before they even reach your server, buying you time to patch vulnerabilities without panic. ### Final Thoughts This Forminator flaw is serious, but it's also fixable with a single update. The real danger lies in ignoring it. If you've been putting off updates or assuming your site is too small to be targeted, this is your wake-up call. Take five minutes right now to check your plugins and update Forminator if needed. Your future self—and your website visitors—will thank you.