WordPress GP Premium plugin <= 2.5.5 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Austin Ginder in WordPress Plugin GP Premium versions = 2.5.5...

WordPress Templately plugin <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability

Authenticated Contributor+ Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Templately versions = 3.7.1...

CVE-2026-15748

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-15748

Wordfence analysis confirms an unauthenticated attacker can chain a forged Select-field record with the regex-compatible ph(p)|text/x-php pattern to bypass the forminator_allowed_mime_types() exact-key blocklist, upload executable PHP, and achieve RCE on sites with a custom upload root lacking .h...

CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

EUVD-2026-60569

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-15748

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-15748: Unrestricted Upload of File with Dangerous Type

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

CVE-2026-73996: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...

CVE-2026-32463: Unrestricted Upload of File with Dangerous Type

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

PT-2026-77059

Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...

CVE-2026-32474: Unrestricted Upload of File with Dangerous Type

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

PT-2026-77041

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

PT-2026-77050

Name of the Vulnerable Software and Affected Versions Templatiq versions prior to 0.2.6 Description An issue allows contributors to perform arbitrary file uploads, which could lead to the upload of unauthorized files to the system. Recommendations Update to a version newer than 0.2.5...

CVE-2026-28192: Unrestricted Upload of File with Dangerous Type

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

PT-2026-77033

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748 , is rated 9.8 out of 10.0 on the CVSS...

WordPress Forminator Forms plugin <= 1.56.1 - Unauth. Arbitrary File Upload

Unauth. Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.56.1...