Threat Overview

Forminator Forms is an active form builder deployed across more than 600,000 WordPress sites for lead generation, job applications, and client intake. A critical vulnerability in its upload handler allows anonymous visitors to bypass extension restrictions and upload executable PHP files directly to the server without logging in. The flaw carries maximum severity because it requires zero privileges, abuses standard public form interactions, and leads directly to complete server takeover.

Threat Metric Technical Details
Severity Rating CRITICAL (CVSS 9.8 / 10.0)
Vulnerability Class Unrestricted Upload of File with Dangerous Type (CWE-434)
Vulnerable Components Forminator Forms plugin, all versions up to and including 1.56.1
Attack Vector Unauthenticated HTTP POST request to form endpoints containing upload fields
Exploitation Status Disclosed with public proof of concept; active scanning underway
Fixed Version 1.56.2 (Current Recommended: 1.57.1)

The Breakdown: How the Exploit Works

The vulnerability resides within the handle_file_upload() function responsible for processing attachments on public form submissions.

To reject dangerous scripts, the plugin checks file extensions against an internal blocklist. However, this check performs exact-key lookups that are bypassed when an attacker supplies pipe-delimited MIME type keys. When a public form contains both a File Upload element and a Select field, the submission handler trusts caller-supplied field configurations passed through the Select parameter. An unauthenticated attacker injects an allowlist override, attaches a crafted PHP script, and submits the form. The server writes the executable payload into a web-accessible directory.

Because web servers running NGINX or custom Apache configurations do not enforce .htaccess execution blocks in custom upload folders, requesting the uploaded script over HTTP executes the payload immediately.

The Operational Risk: What an Attacker Gains

Once a malicious PHP script executes on the host, the boundary between an intake form and the server environment collapses.

Attackers extract database credentials from wp-config.php, dump submitted customer records, inject hidden administrator accounts into the database, and install persistent backdoors. From there, compromised sites are enlisted into botnet networks, used for SEO spam redirection, or leveraged as pivot points to target shared databases and adjacent client sites hosted on the same server.

Our Take in Plain English

“A public contact form should never have the power to write executable instructions to the server that hosts it. Monolithic platforms mix document storage and code execution in the same directory tree, leaving security entirely dependent on every plugin’s internal validation logic. On modern pre-rendered architecture, form submissions terminate at isolated serverless endpoints and media uploads pass straight to sandboxed object storage, rendering malicious payloads completely inert.”

The Modern Architectural Remedy

  • Legacy Dynamic Platform: Processes file uploads through monolithic PHP application handlers and stores user submissions directly on the executable file system of the web server.
  • Modern Pre-Rendered Architecture: Decouples public forms into serverless edge handlers and writes attachments into execution-isolated cloud storage buckets with zero server script execution paths.

Immediate Action Items for WordPress Operators

  1. Update Immediately: Upgrade Forminator Forms to version 1.56.2 or stable 1.57.1 through the WordPress dashboard.
  2. Inspect Upload Paths: Search wp-content/uploads/forminator/ for unfamiliar files carrying .php, .phtml, or .phar extensions.
  3. Audit User Accounts: Check for newly created administrative accounts and unexpected file modifications.
  4. Enforce Directory Restrictions: Configure web server rules to explicitly deny script execution within all upload subdirectories.