CVE-2026-15826-CVE-2026-15748

CVE-2026-15826, CVE-2026-15748 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing...

CVE-2026-15748

Wordfence analysis confirms an unauthenticated attacker can chain a forged Select-field record with the regex-compatible ph(p)|text/x-php pattern to bypass the forminator_allowed_mime_types() exact-key blocklist, upload executable PHP, and achieve RCE on sites with a custom upload root lacking .h...

Exploit for CVE-2026-15748

CVE-2026-15826, CVE-2026-15748 Donate Support the mainten...

CVE-2026-15748

creationtimestamp| type| source ---|---|--- 2026-08-17 20:05:36+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mtcisrxz2p2u 2026-08-17 22:00:44+00:00| seen| https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html 2026-08-18 01:00:32+00:00| seen|...

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748 , is rated 9.8 out of 10.0 on the CVSS...