Ethical Hacking News
Two severe vulnerabilities have been disclosed in popular WordPress plugins, Forminator Forms and User Profile Builder. The flaws, tracked as CVE-2026-15748 and CVE-2026-15826, respectively, have been rated 9.8 out of 10.0 on the CVSS scoring system, indicating a high level of severity. These vulnerabilities have the potential to expose remote code execution and unauthenticated attacks, and site owners are advised to apply the updates as soon as possible to ensure their installations are up-to-date.
Two critical security vulnerabilities were disclosed in Forminator Forms and User Profile Builder plugins, rated 9.8 out of 10.0 on the CVSS scoring system. A vulnerability in Forminator Forms allows unauthenticated attackers to upload arbitrary files, leading to remote code execution and site compromise. A vulnerability in User Profile Builder allows unauthenticated attackers to log in as the site administrator, leading to full administrative takeover. Patches for both vulnerabilities have been released, and users are advised to update their installations as soon as possible. The incidents highlight the importance of ongoing security awareness and the need for developers and users to take proactive measures to protect their systems and data.
The WordPress community has recently faced a critical security alert with the disclosure of two severe vulnerabilities in two popular plugins, Forminator Forms and User Profile Builder. The flaws, tracked as CVE-2026-15748 and CVE-2026-15826, respectively, have been rated 9.8 out of 10.0 on the CVSS scoring system, indicating a high level of severity.
According to Wordfence, a WordPress security company, the vulnerability in Forminator Forms makes it possible for unauthenticated attackers to upload arbitrary files, including executable PHP files, to a vulnerable site, which can lead to remote code execution and complete site compromise. The vulnerability impacts all versions of the plugin before and including 1.56.1 and has been addressed in version 1.56.2 released on July 31, 2026.
The vulnerability is attributed to a lack of sufficient file type validation in user-supplied input, specifically in the "handle_file_upload()" function. This allows an unauthenticated attacker to exploit the loophole to upload any file, including a specially crafted PHP file, to a vulnerable site by submitting a form and achieving remote code execution. Armed with this capability, the attacker can seize control of the site.
Another aspect worth noting here is that, in the default configuration, files are uploaded to a directory protected by an .htaccess file that prevents PHP execution. However, if a site administrator has configured a Custom File Upload Storage root, it may not have the same safeguard as the file is created "only when it is first needed, during a frontend request where the WordPress helper responsible for writing the .htaccess file is not loaded."
The vulnerability was discovered and reported by a security researcher who goes by the online alias "daroo." The disclosure comes days after Wordfence also highlighted another critical authentication bypass bug in User Profile Builder, which has more than 40,000 active WordPress installations, that could allow unauthenticated attackers to log in as the user with ID 1 (typically the site administrator) and take over the site.
The vulnerability in User Profile Builder, tracked as CVE-2026-15826, has a CVSS score of 9.8. It was patched on July 16, 2026, with the release of version 3.16.5. All prior versions are affected by the issue, but it is only exploitable on sites where the plugin's Automatically Log In setting is enabled.
The vulnerability in User Profile Builder is attributed to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1.
This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site. Site owners who have either of the two plugins are advised to apply the updates as soon as possible and ensure their installations are up-to-date.
The disclosure highlights the importance of keeping WordPress plugins up-to-date and using reputable security companies for monitoring and patching vulnerabilities. It also serves as a reminder of the potential risks associated with using unauthenticated file uploads and the importance of implementing proper security measures to prevent such attacks.
In recent times, we have seen numerous vulnerabilities and exploits affecting popular software and plugins. These incidents highlight the importance of ongoing security awareness and the need for developers and users to take proactive measures to protect their systems and data.
In conclusion, the vulnerabilities in Forminator Forms and User Profile Builder plugins serve as a reminder of the importance of security in the digital age. It is crucial for developers, users, and security professionals to stay vigilant and take proactive measures to prevent such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Severe-Vulnerabilities-in-WordPress-Forminator-and-User-Profile-Builder-Plugins-Expose-Remote-Code-Execution-and-Unauthenticated-Attacks-ehn.shtml
https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
https://nvd.nist.gov/vuln/detail/CVE-2026-15748
https://www.cvedetails.com/cve/CVE-2026-15748/
https://nvd.nist.gov/vuln/detail/CVE-2026-15826
https://www.cvedetails.com/cve/CVE-2026-15826/
Published: Mon Aug 17 15:45:40 2026 by llama3.2 3B Q4_K_M
