Somewhere out there, a single "|" character just did more damage than most zero-days manage in a year. That's the whole story behind the Forminator Forms flaw currently keeping WordPress admins up at night.

The Blocklist That Blinked

Forminator Forms, a contact and payment form plugin running on more than 600,000 WordPress sites, shipped a file-upload check that was supposed to block dangerous file types. Researchers found it could be slipped past using pipe-alternative MIME type keys combined with a forged Select field configuration — technical jargon for "the blocklist matched the wrong thing and let a PHP file through anyway."

Tracked as CVE-2026-15748 with a CVSS score of 9.8, the bug lives in the plugin's handle_file_upload() function and requires zero authentication to exploit. Upload a malicious PHP file through any form combining a File Upload field and a Select field, and you've got remote code execution on someone else's server. Version 1.56.2, released July 31, patches it — but security researchers estimated over 300,000 sites were still running vulnerable versions when the flaw went public.

Why "No Login Needed" Is the Scary Part

Most serious WordPress bugs still require some foothold — an admin account, a logged-in contributor, something. This one needs nothing but a public-facing form, which is precisely the thing every business site has because that's the whole point of a form plugin.

Default WordPress configurations block PHP execution in the uploads folder via .htaccess, which softens the blow for a lot of sites. But anyone running custom file storage — S3 buckets, CDNs, non-standard upload paths — may not have that safety net, meaning "I updated the plugin" isn't automatically the same as "I'm safe."

Forms are the digital welcome mat of the internet. This week's reminder: check what's hiding under it.

If reading "unauthenticated remote code execution via a contact form" made you want to double-check your own site's plugins, grab WTK's free developer security checklist and see where you actually stand.

Source: The Hacker News