Forminator CVE-2026-15748 Bypasses MIME Blocklist via Pipe Keys and Forged Select Fields

The flaw resides in handle_file_upload where exact-key matching on dangerous-extension blocklists is defeated by pipe-alternative MIME type keys. An attacker injects a forged Select field value to override upload configuration, then submits a crafted PHP file through the public handler. Wordfence traced the root cause to insufficient validation that trusts attacker-controlled field metadata without server-side MIME re-inspection.

Default uploads land in directories guarded by .htaccess denying PHP execution, yet custom File Upload Storage roots skip this safeguard because the WordPress helper writing the file is never invoked during frontend requests. This creates an immediate execution path once the file is requested. The same pattern appears in prior WordPress plugin disclosures where configuration overrides bypass default hardening.

Disclosure timing aligns with the separate CVE-2026-15826 auth bypass in User Profile Builder, suggesting coordinated researcher focus on high-installation plugins. Both issues were patched within two weeks, yet 600,000 Forminator sites remain exposed until administrators apply 1.56.2. Procurement records show no corresponding WAF rule updates from major providers within the first 72 hours.

Monitoring of public exploit repositories and honeypot telemetry will determine whether in-the-wild usage emerges before mass scanning campaigns begin. Site operators should audit forms for combined File Upload and Select fields and enforce server-level MIME enforcement independent of plugin settings.