CVE-2026-15748 is a critical arbitrary file upload vulnerability in the Forminator Forms WordPress plugin (up to version 1.56.1). The handle_file_upload function fails to properly validate file types because the dangerous-extension blocklist uses exact-key matching, which attackers can bypass using pipe-alternative MIME type keys. Additionally, the public submission handler accepts attacker-controlled upload field configurations injected via a forged Select field value. This combination allows unauthenticated attackers to upload potentially executable files, enabling remote code execution.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable ones, leading to full remote code execution on the affected system. This compromises confidentiality, integrity, and availability of the WordPress site and potentially the underlying server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict public access to upload functionality if possible and monitor for suspicious file uploads. Avoid relying solely on the plugin's file type validation.