Description

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T06:16:40.670Z",
  "pubdate": "2026-08-18T06:16:40.670Z",
  "executiveSummary": "The Forminator Forms plugin for WordPress is susceptible to an Arbitrary File Upload vulnerability affecting all versions up to and including 1.56.1. This critical security flaw stems from insufficient file type validation mechanisms implemented within the handle_file_upload function.\nThe vulnerability allows unauthenticated remote attackers to upload arbitrary files, potentially including executable payloads, leading directly to remote code execution on the underlying hosting server. The risk implications are severe, as successful exploitation grants attackers full control over the affected WordPress installation.\nExploitation requires no prior authentication or administrative privileges, exposing the vulnerable component directly via public submission handlers. Attackers achieve execution by manipulating the upload field configuration through forged Select field values, bypassing the flawed security controls.",
  "technicalDetails": "The root cause of this vulnerability lies in the flawed implementation of the dangerous-extension blocklist within the handle_file_upload function of the Forminator Forms plugin. Specifically, the blocklist performs exact-key matching for MIME types, which fails to account for pipe-alternative MIME type keys. This logical flaw allows malicious input to circumvent the file type restrictions.\nThe attack flow begins when an unauthenticated attacker targets the public submission handler exposed by the plugin. By injecting attacker-controlled upload field configuration data via a forged Select field value, the adversary alters the expected parameter behavior. Because the handler implicitly trusts this manipulated configuration, the validation logic is bypassed entirely.\nThe vulnerable component is the handle_file_upload function within the Forminator Forms plugin, impacting all versions up to and including 1.56.1. Network exposure is universal, as the public submission handler is accessible over the web without authentication or privilege requirements.\nOnce the file type validation is evaded, the payload behavior permits the storage of executable files within the web-accessible directories of the WordPress environment. Post-exploitation impact includes arbitrary remote code execution, enabling attackers to execute system commands, compromise sensitive database contents, or pivot further into the internal network infrastructure."
}