Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-08-17 18:22 UTC
  • Importiert: 2026-08-24 13:24 UTC
  • CVSS: 9.8
  • Quelle-ID: thn_global
  • uid_hash: 48fc51668de08d9e5eba04aa1908857281d2f622ac32f5480f3edb29cd6c928c

Inhalt

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.

The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2026-15748

CRITICAL

9.8

CRITICAL

9.8

2026-08-18

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
The Hacker News

thn_global

security_news - de https://feeds.feedburner.com/TheHackersNews