CRITICALVulnerability
Global

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

·Source: The Hacker News

Updated:

Executive Summary

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "

Analysis

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "

Indicators of Compromise (1)

CVE (1)
CVE-2026-15748
NVDMITRE CVE
Source Attribution

Originally published by The Hacker News on Aug 17, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Trading Technologies expands prediction markets and crypto derivatives access

Trading Technologies International, Inc. (TT), a global capital markets technology provider, and Crypto com, global digital asset and financial services platform, today announced TT will support connectivity to OG.com, Crypto.com’s CFTC-regulated exchange and clearinghouse, on the TT® platform.

Finextra
MEDIUMVulnerabilityNEW

AI-Driven Vulnerability Surge Breaks the Traditional Patching Model

Rapid7 warns that traditional patch cycles cannot keep pace with soaring vulnerability disclosures and faster exploitation, forcing defenders to prioritize exposure over severity scores. The post AI-Driven Vulnerability Surge Breaks the Traditional Patching Model appeared first on SecurityWeek .

SecurityWeek
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-75854 — ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability i...

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data. Attackers can connect to the Redis port and execute arbitrary commands against any database on the server without providing credentials, bypassing all security gates.

CVE-2026-75854
NIST NVD