Affected Systems
Forminator Forms WordPress plugin versions ≤1.56.1. Affects 600,000+ active installations. Exploitation requires a form with both File Upload and Select fields. Sites using custom file upload storage paths are at higher risk.
Exploitation Status
No active exploitation reported. Vulnerability publicly disclosed with technical details. Exploit requires specific form configuration (File Upload + Select field), lowering likelihood of mass exploitation but enabling targeted attacks.
Business Impact
Unauthenticated attackers can upload malicious PHP files to achieve remote code execution and full site compromise. Default configurations with standard upload directories have partial mitigation via .htaccess protections, but custom storage paths lack this safeguard. Complete administrative takeover possible on vulnerable sites meeting prerequisites.
Urgency
🔴 Immediate
Recommended Actions
- Update Forminator Forms plugin to version 1.56.2 or later immediately on all WordPress installations
- Audit all Forminator forms for presence of both File Upload and Select fields; disable or remove forms meeting this criteria until patched
- Review custom file upload storage configurations and verify .htaccess protections are in place to prevent PHP execution
- Scan wp-content/uploads and custom upload directories for suspicious PHP files uploaded between plugin installation and patch deployment
- Monitor web server access logs for POST requests to Forminator form endpoints with unusual file upload activity