MELBOURNE, 19 AUG 2026 — A flaw in Forminator Forms, a WordPress plugin with more than 600,000 active installations, lets an unauthenticated visitor upload a PHP file and take over the site. A patch has been available since 31 July, and roughly half of installations are still running a vulnerable version.
That gap is the story. The fix is free, it takes one click, and yet about 300,000 sites have not applied it.
The flaw
The defect sits in the handle_file_upload() function, which does not sufficiently validate the type of a user-supplied file. An unauthenticated attacker can therefore upload any file, including a PHP script, and a PHP script that lands in a web-served directory is a shell.
Exploitation has one precondition: the site must have a form with both a File Upload field and a Select field. Not every installation is exploitable, which is why the exposed population is smaller than the installed base — though nobody outside can tell which sites qualify.
Wordfence validated the report on 14 July and disclosed it to the developers the same day. The vendor shipped 1.56.2 on 31 July.
The interesting number is the one that did not move
Three weeks after a free fix for a 9.8, half the installed base has not taken it. That is not negligence by 300,000 individual people. It is what happens when the patching decision belongs to nobody in particular.
A WordPress site with a contact form is usually not owned by a technology team. It belongs to a restaurant, a clinic, a school, a small manufacturer — built once by an agency, handed over, and left running. There is no maintenance contract, no vulnerability feed, and no one whose job includes reading plugin changelogs.
Auto-updates exist and are off by default for plugins on a great many installations, often because an update once broke something and somebody turned them off. The result is an enormous population of sites where the patch is available, trivial, and will simply never be applied until something goes wrong.
Why this matters more here than the raw numbers suggest
WordPress runs a very large share of small-business web presence across Southeast Asia, and the economics that make it dominant are the same economics that leave it unpatched.
A regional small business builds a site once, for a fixed fee, with a form on it so customers can get in touch. The agency that built it moved on. Nobody has budgeted for maintenance because nothing about the site appears to require any. That site now has a contact form, an upload field, and a known path to remote code execution.
The consequence is rarely dramatic for the site owner but is damaging for everyone else. A compromised small-business site is not usually ransomed; it is quietly used — to host phishing pages, to serve malware, to send spam, or as a staging point. The owner may never notice, which is precisely why the population stays compromised.
We reported this month on a poisoned update feed creating rogue WordPress administrators. The pattern is consistent: the WordPress plugin ecosystem is where a very large number of low-attention sites meet a very large number of independently maintained code bases.
There is a second-order effect. Hosting providers see this population in aggregate; some patch on the customer's behalf, either through managed WordPress plans or by pushing plugin updates centrally. Where that happens, the unpatched proportion falls quickly and quietly. Where a site sits on generic shared hosting bought for a few dollars a month, nobody is watching at all, and that is the tier most regional small businesses occupy.
What to do, in the order that matters
Update Forminator to 1.56.2 or later first. It takes a minute and it is the whole fix.
Then assume the possibility of prior compromise rather than the absence of it, because the patch closes the door and evicts nobody. Look in the upload directories for PHP files that should not be there, check for administrator accounts you did not create, and verify that your server does not execute code from the uploads path — that last control would have contained this flaw entirely, and it is a web-server configuration rather than a plugin setting.
If you run sites on behalf of clients, the useful move this week is a list. Which client sites run Forminator, which versions, and who has authority to press update. Most agencies cannot answer that in under a day, which is itself the finding.
The pattern across three stories this week
We wrote yesterday about an unauthenticated GitLab flaw and an actively exploited flaw in the Ray framework. Put those beside this one and the common factor is not the technology.
In each case, the patch is available. The binding constraint is organisational — knowing what software you run, which version, and who is empowered to update it. GitLab's exposure sits with self-managed enterprises, Ray's with data scientists whose laptops nobody catalogued, and Forminator's with small businesses that have no technology function at all.
That is the same discovery problem in three different populations, and it is why 88 per cent of exploitation landing inside 48 hours is such an uncomfortable statistic. The industry produces patches quickly but still has not solved the problem of knowing where the software is running.
What we could not establish
How many of the 600,000 installations actually meet the exploitation precondition. A form needs both a File Upload field and a Select field. With no survey of form configurations available, the exploitable population could be a large fraction of the vulnerable half or a small one.
Also unestablished: whether exploitation has been observed in the wild; whether any compromise has been attributed to this flaw; the regional distribution of vulnerable installations; how the 50 per cent figure was measured and over what window; and whether the vendor has attempted any notification beyond the standard update channel.
What to watch
Mass scanning is the first thing. A 9.8 in a plugin with a six-figure install base and a public patch diff is exactly the target that gets swept at scale, and the interval between a working exploit and internet-wide probing is now measured in hours rather than weeks.
Then watch whether the patched proportion moves at all. If it is still near half in a month, that is a statement about the ecosystem, not just this plugin. It’s the number that defines the risk for small-business web security.
Finally, watch for compromised sites turning up in other people's incidents. This class of flaw rarely produces a headline about the victim. It produces phishing pages hosted on a florist's website, and those show up in somebody else's investigation months later.
View author profile → · Editorial policy
