If your website runs on WordPress, there is a good chance it uses a plugin to power its contact or signup forms, and this week one of the most popular ones turned out to have a serious hole. A critical flaw in Forminator, a form builder installed on more than 600,000 WordPress sites, lets an attacker take over the whole site without logging in. A fix has been out since late July, but when the details went public this week, an estimated 300,000 sites were still running a vulnerable version. If you use Forminator, this is a today problem.
What happened
The flaw, tracked as CVE-2026-15748 and rated 9.8 out of 10, is an unauthenticated file-upload vulnerability. In plain terms, the plugin did not properly check what kind of file someone could upload through a form, so an attacker can upload an executable file and use it to run their own code on your server. No account, no password, no clicking required on your end. From there they can install a backdoor, deface or redirect your site, plant malware for your visitors, or use your server for their own purposes.
Why it matters for a small business
Your website is often your most public asset, and a compromised one is a direct hit to trust: customers who land on a hacked page, a site quietly serving malware, or an outage right when someone is trying to reach you. Forminator's maker released a fixed version (1.56.2) on July 31, which is the good news. The bad news is the gap this exposes: hundreds of thousands of sites had not updated weeks later, which is exactly how a patched flaw still turns into real breaches. Attackers move fastest right after details are published, against everyone who has not updated yet.
What to do
- Check if you use Forminator, and update it to version 1.56.2 or later right now. If you are not sure what plugins your site runs, that is worth finding out today.
- Turn on automatic updates for your WordPress plugins, so the next critical fix lands without anyone having to remember.
- Look for signs of compromise if you were slow to patch: unexpected admin users, unfamiliar files, or new plugins you did not install. When in doubt, have someone check.
- Treat your website as part of your attack surface. Every plugin is code running on your server, and someone needs to be responsible for keeping it current.