Forminator site owners should update to version 1.56.2 or later immediately. CVE-2026-15748 affects Forminator versions through 1.56.1 and can allow an unauthenticated visitor to place unsafe files through an exposed form workflow.
The Forminator changelog identifies version 1.56.2 as the release that fixes the arbitrary file upload vulnerability. WordPress.org currently lists version 1.57.0, which is beyond the affected range. No source reviewed for this post confirms active exploitation, but the published severity and the plugin’s broad adoption make prompt maintenance appropriate.
Who Should Update
- WordPress sites running Forminator 1.56.1 or an earlier release.
- Sites with public contact, application, registration, payment, quiz, or other Forminator forms.
- Managed WordPress customers whose host or agency controls plugin maintenance.
Update Forminator Safely
- Confirm the installed Forminator version in the WordPress Plugins screen or managed-host control panel.
- Use the site’s normal approved maintenance and recovery process. Do not create or alter a backup schedule solely for this update.
- Update Forminator to 1.56.2 or later through the normal WordPress update workflow. The current WordPress.org release is newer than the fixed version.
- Keep WordPress core, the active theme, and related form or payment extensions current as part of routine maintenance.
Verify Public Forms After Updating
- Confirm the installed Forminator version is 1.56.2 or later.
- Have an authorized site owner test a representative public form using the site’s normal submission policy.
- Confirm approved notification, payment, confirmation, and moderation workflows still work as intended.
- Review normal WordPress and hosting security telemetry for unexpected form errors or unfamiliar files, then handle validated findings through the established support process.
If You Cannot Update Immediately
Restrict unnecessary public forms that accept files, keep administrator access limited to approved users, and arrange a supported maintenance window as soon as practical. A temporary restriction can reduce exposure, but it does not replace installing the fixed release.
Related FixItPhill Guidance
For maintenance assistance, visit the FixItPhill WordPress support hub. The WordPress security plugin setup guide can help establish an ongoing update and review workflow.