> TritonInfoSec News
Home / Aug 18, 2026 / Story
0
#4 The Hacker News general August 17, 2026 at 18:22 UTC

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

By [email protected] (The Hacker News)

AI Summary

CVE-2026-15748 (CVSS 9.8) is a critical unauthenticated remote code execution vulnerability in the Forminator Forms WordPress plugin, which has over 600,000 active installations. Exploitation is possible via malicious PHP file uploads, making this a mass-exploitation risk for the large number of WordPress sites running the plugin.

Read full article → https://thehackernews.com/2026/08/forminator-wordp…

Relevance score: 83.0/100

# More from August 18

  1. 1
    Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware The Hacker News
  2. 2
    Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure SecurityWeek
  3. 3
    Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects The Hacker News
  4. 5
    Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner The Hacker News
  5. 6
    Microsoft working on Defender patch for ShieldBreak zero-day BleepingComputer
  6. 7
    Certighost and the Privilege Hiding in Your Certificate Authority BleepingComputer
  7. 8
    Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth The Hacker News
  8. 9
    Poland probes MyDr healthcare software breach potentially affecting 19 million people The Record
  9. 10
    Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups The Hacker News