A vulnerability in the Forminator Forms WordPress plugin allows attackers to upload malicious files to websites without login credentials, risking full site compromise.
The issue affects versions of the plugin containing forms with both a File Upload field and a Select field. While the plugin has over 600,000 active installations, only sites with that specific configuration are exposed.
How the vulnerability works
Unauthenticated attackers could exploit the weakness to upload arbitrary files, including executable PHP files. Success would enable remote code execution, giving attackers control over the affected server.
A compromised WordPress site could face severe consequences. Content might be altered, malicious user accounts created, or malware distributed. Sensitive data stored on the server could also be accessed, and the risk extends to visitors or connected systems.
Patch and mitigation steps
The Forminator development team released a patched version, 1.56.2, on July 31 after a report from Wordfence. The security firm had disclosed the vulnerability through its Vulnerability Management Portal on July 14, and the developer acknowledged the issue on July 20.
Related: Prepay Services Appoints Peter Cox as Non-Executive Chairman
Administrators should update the plugin immediately. Other recommended steps include:
- Reviewing forms that use both File Upload and Select fields
- Checking security logs for unusual file-upload activity or unexpected changes
- Verifying recently created administrator accounts for suspicious activity
- Ensuring WordPress core, themes, and other plugins are up to date
- Maintaining regular, tested backups
- Using a web application firewall with malicious file upload protection
Wordfence stated that its firewall, including the free version, blocks exploits targeting this vulnerability.
The incident highlights risks tied to third-party WordPress plugins, especially those handling file uploads. Proper validation is essential since attackers often disguise malicious code as legitimate files. For businesses using WordPress, treating plugin updates as a routine security practice can prevent similar breaches.
The patch resolves the immediate threat, but the plugin’s large user base means many sites remain unprotected until administrators act. The disclosure also shows how responsible reporting helps address vulnerabilities before widespread exploitation.
Owners who haven’t updated should prioritize the fix. The combination of unauthenticated access and remote code execution makes this flaw particularly dangerous. Though the required form configuration limits exposure, the potential impact demands caution.
