WordPress — Critical Flaws in Forminator and User Profile Builder Enable RCE and Admin Takeover (CVE-2026-15748, CVE-2026-15826)

Publication date: August 17, 2026
Category: Vulnerability / Website Security

Introduction

Within the WordPress content management ecosystem, third-party plugin security remains a critical attack vector. Two critical vulnerabilities have been disclosed, both assigned a CVSS v3.1 base score of 9.8 out of 10.0. The first affects the Forminator Forms plugin (powering over 600,000 active installations), discovered by security researcher “daroo”, and enables unauthenticated remote code execution (RCE) via malicious PHP file uploads (CVE-2026-15748). The second vulnerability, identified in User Profile Builder (exceeding 40,000 active installations), involves a type confusion-based authentication bypass (CVE-2026-15826) allowing unauthenticated attackers to impersonate the site administrator account (User ID 1).

What is Forminator Forms and User Profile Builder? (General Analysis)

Forminator Forms is a widely adopted WordPress plugin used for creating complex forms, polls, quizzes, and payment gateways. By handling user-submitted data and file uploads through public-facing interfaces, the plugin processes sensitive input and storage workflows. The CVE-2026-15748 flaw transforms this utility feature into a severe critical attack vector.

  • CVSS v3.1 Score: 9.8 (CRITICAL) — Confirmed by NVD.
  • Official CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Confirmed.
  • Official CWE Classification: CWE-434 (Desrestriction of File Upload with Dangerous Type) — Confirmed.

Conversely, User Profile Builder manages user registrations, front-end profiles, and authentication routines. The CVE-2026-15826 vulnerability exposes the internal authentication logic of the plugin to data-type anomalies.

  • CVSS v3.1 Score: 9.8 (CRITICAL) — Confirmed by NVD.
  • Official CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Confirmed.
  • Official CWE Classification: CWE-704 (Incorrect Type Conversion or Cast) — Confirmed.

How Does It Work? (Technical Analysis)

CVE-2026-15748: Arbitrary File Upload in Forminator Forms

  • Initial Entry Flow: The attack vector initiates through the handle_file_upload() function. The application processes public form submissions containing both File Upload fields and Select fields.
  • Flaw Mechanism: The dangerous-extension blocklist performs an exact-key matching validation. This check is insufficient and can be bypassed using pipe-alternative MIME type keys. By injecting a forged Select field value, an attacker manipulates the upload field configuration, causing the public submission handler to blindly trust the input.
  • Code Execution: By default, files are uploaded to directories protected by .htaccess files blocking PHP execution. However, if a site administrator has configured a Custom File Storage root, this safeguard may be absent because the directory is created upon the first request during a frontend request where helper routines writing the .htaccess file are not loaded. Consequently, requesting the uploaded file directly triggers the web server to execute the attacker-controlled PHP code.

CVE-2026-15826: Type Confusion Authentication Bypass in User Profile Builder

  • Initial Entry Flow: Triggered during public user registration when an attacker submits a username ranging from 61 to 70 characters in length.
  • Flaw Mechanism: The wppb_log_in_user() function prematurely invokes absint() on the return value of wp_insert_user() prior to performing the essential is_wp_error() check.
  • Evasion and Coercion: WordPress core rejects the registration request, returning a WP_Error object. However, absint() coerces that object into integer 1 before the error check can short-circuit execution. As a result, the plugin binds and returns a transient-backed auto-login nonce tied directly to User ID 1, granting full administrative access to the unauthenticated attacker.

Affected Systems / Environments

The impacted components and versions include:

CVECategory (CWE)ImpactCVSSVector (summary)
CVE-2026-15748CWE-434Remote Code Execution (RCE)9.8Network / No Auth / No UI
CVE-2026-15826CWE-704Authentication Bypass / Takeover9.8Network / No Auth / No UI
  • Forminator Forms (WordPress Plugin): All versions up to and including 1.56.1 (affecting sites utilizing forms with File Upload fields combined with Select fields).
  • User Profile Builder (WordPress Plugin): Versions up to and including 3.16.4 (exploitable only on sites where the Automatically Log In setting is enabled).

Mitigation and Detection

Remediation

  • Priority Updates: Immediately update Forminator Forms to version 1.56.2 or higher (patched on July 31, 2026) and User Profile Builder to version 3.16.5 or higher (patched on July 16, 2026).
  • Storage Hardening: Audit form plugin storage directories to guarantee that .htaccess configuration files are correctly deployed and preventing script execution within upload destinations.
  • Account Auditing: Periodically review administrator accounts for anomalous entries or unauthorized modifications to User ID 1.

Detection

  • Monitor web access logs for HTTP POST requests directed toward form handling endpoints (admin-ajax.php or frontend processing routes) containing executable file extensions or username payloads of anomalous lengths (61-70 characters).
  • Deploy deep packet inspection rules (WAF/IDS) to detect input anomalies within file upload parameters and registration data fields.

“The combination of input validation logical flaws and the premature execution of native functions without prior type-error checks exposes entire software platforms to immediate administrative compromise.”

Wrapping Up

The analyzed vulnerabilities highlight how input validation flaws and data handling oversights within the WordPress ecosystem can rapidly escalate to critical remote code execution and administrative takeover. Diligent patch management by developers and secure coding practices remain fundamental to shrinking the attack surface in enterprise and commercial deployments.

References