Filtered by tag: remote code execution × Clear
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.