---
id: 6586
title: "CVE-2026-15748 — WPMU DEV Forminator Forms Select Field Injection Unrestricted File Upload"
cve: CVE-2026-15748
vendor: "WPMU DEV"
product: "Forminator Forms plugin for WordPress"
affected_versions: "through 1.56.1; fixed in 1.56.2"
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260818-cve-2026-15748-wpmu-dev-forminator-forms-select-field-injection-unrestricted-file-upload/"
published_at: "2026-08-18T00:00:00Z"
tags: ["ai-security", "rce", "wordpress", "authentication", "vulnerability", "cve", "file-upload", "forminator", "cve-2026-15748"]
phying_url: "https://phying.com/item/6586"
lang: en
---

# CVE-2026-15748 — WPMU DEV Forminator Forms Select Field Injection Unrestricted File Upload

## Summary

Aretiq on CVE-2026-15748: Forminator Forms (600k+ installs) lets unauthenticated attackers bypass its file-extension blocklist and upload PHP files for remote code execution; fixed in 1.56.2.

## Why it matters

This research provides technical context that security teams can use for monitoring and validation.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-15748
- **Vendor:** WPMU DEV
- **Product:** Forminator Forms plugin for WordPress
- **Affected versions:** through 1.56.1; fixed in 1.56.2
- **Published:** 2026-08-18T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260818-cve-2026-15748-wpmu-dev-forminator-forms-select-field-injection-unrestricted-file-upload/
- **Phying News:** https://phying.com/item/6586