Forminator and User Profile Builder for WordPress — Critical Unauthenticated RCE and Auth Bypass Vulnerabilities (CVE-2026-15748, CVE-2026-15826)

Publication date: August 17, 2026
Category: Vulnerability / Website Security

Introduction

The WordPress ecosystem faces renewed critical security risks following the disclosure of high-severity vulnerabilities in two popular plugins: Forminator Forms and User Profile Builder. Discovered and reported by security researchers and analyzed by firms such as Wordfence, these flaws expose hundreds of thousands of active websites to full administrative takeover by unauthenticated threat actors. The combination of arbitrary malicious file uploads and type confusion session management highlights the urgent need to maintain third-party components in production environments.

What is Forminator Forms and User Profile Builder? (General Analysis)

Forminator Forms is a multifunctional form builder plugin for WordPress with over 600,000 active installations, used to collect user data, process payments, and handle file uploads. Meanwhile, User Profile Builder is a registration and user profile management tool boasting over 40,000 active installations.

The compromise of these plugins represents an extremely dangerous attack vector:

  • CVE-2026-15748: Arbitrary File Upload vulnerability in Forminator Forms (versions up to 1.56.1). It holds an official CVSS v3.1 score of 9.8 (CRITICAL) with the exact vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classification CWE-434 (Improper Control of Generation of Code / Unrestricted File Upload). This data is a confirmed fact provided by the NVD.
  • CVE-2026-15826: Authentication Bypass vulnerability via Type Confusion in User Profile Builder (versions up to 3.16.4). It holds an official CVSS v3.1 score of 9.8 (CRITICAL) with the exact vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and classification CWE-704 (Incorrect Type Conversion or Cast). This data is a confirmed fact provided by the NVD.

How Does It Work? (Technical Analysis)

Detailed analysis of the exploitation vectors reveals complex logical flaws in both user input handling and PHP data type conversion.

  • Exploitation Mechanism in CVE-2026-15748 (Forminator Forms):

    • Input Flow: The handle_file_upload() function processes file uploads submitted via public forms. Type validation implements an exact-key matching blocklist.
    • Filter Evasion: This restriction can be bypassed using pipe-alternative MIME type keys combined with a public submission handler that blindly trusts attacker-controlled upload field configuration injected via a forged Select field value.
    • Code Execution: If an administrator has configured a custom file upload storage root, the resulting directory may lack default .htaccess protections that block PHP execution, allowing the attacker to invoke and execute arbitrary code directly.

  • Exploitation Mechanism in CVE-2026-15826 (User Profile Builder):

    • Type Confusion: The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() prior to performing an is_wp_error() check.
    • Registration Manipulation: When a registration is submitted with a username between 61 and 70 characters long, WordPress core rejects it by returning a WP_Error object.
    • Integer Coercion: However, the absint() function coerces that object into the integer 1 before the error check can short-circuit execution. Consequently, the plugin generates and binds an automatic login nonce tied to user ID 1 (the site Administrator), granting full administrative control without requiring prior credentials.

Affected Systems / Environments

Vulnerable environments include WordPress-based websites running the affected plugin versions under specific configurations.

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-15748 CWE-434 Remote Code Execution (RCE) 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-15826 CWE-704 Authentication Bypass / Takeover 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Forminator Forms: All versions up to 1.56.1 (requires forms containing both a File Upload field and a Select field).
  • User Profile Builder: Versions up to 3.16.4 (exploitable primarily on sites where the Automatically Log In setting is enabled).

Mitigation and Detection

Remediation

  • Priority Update: Immediately update Forminator Forms to version 1.56.2 or higher (patched on July 31, 2026).
  • Update User Profile Builder: Update User Profile Builder to version 3.16.5 or higher (patched on July 16, 2026).
  • Storage Review: Verify that custom file upload directories in Forminator enforce strict web server rules to prevent script execution inside upload folders.

Detection

  • Log Monitoring: Inspect access logs for suspicious HTTP POST requests directed at form processing endpoints containing unauthorized file extensions (.php, .phtml, .phar) or unusually long usernames (61-70 characters) in registration payloads.
  • Integrity Auditing: Utilize file integrity monitoring tools to detect unauthorized executable scripts within media upload directories (wp-content/uploads/).

“The presence of critical vulnerabilities with maximum CVSS scores in plugins with hundreds of active installations demonstrates that threat actors continue to automate the exploitation of logic flaws and input validation oversights to achieve friction-free code execution.”

Wrapping Up

The vulnerabilities CVE-2026-15748 and CVE-2026-15826 underline the inherent risks associated with unsafe input processing and incorrect return type assumptions in complex web applications. The combination of unvalidated file uploads and type confusion flaws allows external attackers to bypass access controls and seize control of server infrastructure. Prompt application of official patches released by developers remains the only effective defense to mitigate complete compromise risks.

References