Forminator just shipped 1.57.1. Update the plugin today

If your WordPress site still runs Forminator Forms below 1.57.1, the contact form on the front page is not just a lead tool. On older builds an attacker can forge an upload field and drop a file the server will run. WPMU DEV closed the worst of that hole in 1.56.2, then shipped a full August 18 security cascade that ends at 1.57.1. Open Plugins, take the update, and confirm the version on the Plugins list. That is the whole job for most home and shop sites.

Overview

What broke

Forminator is the free form builder from WPMU DEV that sits on more than 600,000 WordPress sites. Contact forms, payment forms, quizzes, and registration flows all ride the same plugin. CVE-2026-15748 is the row that matters most for this brief. It is an unauthenticated arbitrary file upload that can become remote code execution. In plain English: someone who never logged into your dashboard can trick the plugin into accepting a file that should never have been allowed, then run it on the host.

Wordfence and the CVE record describe the trick as a forged Select-to-Upload field configuration. You do not need to understand the field type to act. You need the fixed build. The security floor for that upload hole is Forminator 1.56.2, released 30 July 2026. Anything at or below 1.56.1 is still on the bad side of that CVE. A site that “only takes name and email” is still in range if the vulnerable code is loaded.

August 18 did not stop at one patch. The Forminator plugin page changelog for that day lists a cascade: Multisite registration, payment processing, privilege escalation, PHP object injection, Hub-Connector hardening, and several cross-site scripting fixes across 1.57.0.1 through 1.57.1. Privilege escalation means a lower account pushing into a higher one. Object injection means crafted data turning into code paths the developer did not intend. XSS is hostile script riding a page a logged-in admin already trusts.

The current wordpress.org download is 1.57.1. That is the floor this brief uses, not the July upload-only fix. If Plugins still shows 1.56.x or an early 1.57 build below 1.57.1, you are behind both the critical upload fix and the August 18 stack.

Who is in range

You, plus the shop. Anyone who runs a self-hosted WordPress site with Forminator active and still below 1.57.1. That includes a blog that only uses a contact form, a clinic booking page, a small store with Stripe or PayPal fields, and a Multisite network that lets people register new sites through Forminator.

Managed WordPress hosts do not always push plugin updates for you. If you can open wp-admin and see Forminator on Plugins, you are the person who has to click Update. A staging copy that still mirrors production is in range until both show 1.57.1. A freelancer laptop that holds a local copy of the client site is in range if that copy is reachable or later gets pushed live.

What the vendor shipped

• Forminator 1.56.2 (30 July 2026): arbitrary file upload fix for CVE-2026-15748.
• Forminator 1.57.0.1 through 1.57.1 (18 August 2026): Multisite registration, payment, privilege escalation, PHP object injection, Hub-Connector, and XSS security fixes.
• Current wordpress.org package: Forminator 1.57.1.

The in-dashboard path is Plugins, find Forminator, Update now. You can also download the zip from the plugin page and upload it if auto-update is blocked. Confirm the version string on the Plugins list after the page reloads. Auto-updates help only if they already ran and the list already shows 1.57.1.

What this is not

• Not a WordPress core update. Core has its own Dashboard, Updates path and its own draft this week.
• Not fixed by updating only to 1.56.2 if you can take 1.57.1. The August 18 stack is still outstanding on anything below 1.57.1.
• Not a hosted form service off your site. This is the plugin files on your WordPress install.
• Not proof that your site was already hit. Public disclosure does not equal a victim list for your domain.
• Not done if the update downloaded but the Plugins list still shows an older number.

The patch is on wordpress.org. Plugins is already in your admin menu. That is the cheap window.

Who can skip

• Plugins already shows Forminator 1.57.1 or newer, and you reloaded the Plugins page once after the update.
• Forminator is not installed on any WordPress site you control.
• You only use a hosted website builder with no Forminator plugin (Squarespace, Wix, and similar).
• WordPress.com simple sites without a Forminator install on a self-hosted copy.

Why it matters

A contact form is often the one plugin a small site never updates because it still “works.” An unauthenticated upload hole turns that habit into a full server problem. The attacker does not need an Author account. They need a vulnerable Forminator build facing the internet.

CVE-2026-15748 is scored as critical for a reason. Remote code execution on a WordPress host is how spam redirects, card skimmers, and locked-out admins start. The July 30 fix closed the upload path. The August 18 cascade closed a pile of other privilege and injection bugs that still matter if you stopped at an early 1.57 build.

Neither the CVE record nor WPMU DEV has to claim mass exploitation for the update to be worth fifteen minutes. Public details plus a 600,000-install footprint are enough. Waiting is how a form plugin becomes the softest door on the shop site while you keep answering “we got your message” emails.

If you manage sites for friends or a small office, put Forminator on the same checklist as core and the theme. One stale plugin on one forgotten brochure site is enough. Fifteen minutes in Plugins beats a weekend cleaning a shell from uploads.

The bottom line

In wp-admin

1. Open your site and go to /wp-admin. Sign in with an Administrator account.
2. In the left menu click Plugins, then Installed Plugins.
3. Find Forminator Forms (sometimes labeled Forminator). Look at the version under the name.
4. If you see an Update now link, click it. Wait until WordPress finishes. Refresh the Plugins page.
5. Confirm the version reads 1.57.1 or a later 1.57.x / newer line. Do not stop at 1.56.2 if 1.57.1 is offered.
6. If the site uses a caching plugin or a host cache, purge once so the front-end form still loads after the update.

If Update now never appears

Open the Forminator page on wordpress.org, download the 1.57.1 zip, then in wp-admin go to Plugins, Add New, Upload Plugin. Choose the zip and install. When WordPress asks to replace the current version, confirm. Reactivate Forminator if it deactivated. Read the version on Plugins again.

A host that locks plugin installs will block both paths. Open a ticket and ask them to push Forminator 1.57.1. Give them the wordpress.org download link. That is still the same build. Do not install a random “Forminator null” zip from a search ad.

Other sites in the house

1. Staging and backup clones that stay online: same Plugins check tonight.
2. A second brand site or a Multisite network: every site that lists Forminator needs 1.57.1.
3. WordPress core updates are separate. Take them from Dashboard, Updates when you are ready. They do not replace this plugin click.

What you should see

On Installed Plugins, under Forminator, the version line should read 1.57.1 or newer. The Update now nag for Forminator should be gone. Submit a test entry on your live contact form once. You should get the usual success message and an admin email if you had those before. You do not need to rebuild the form or re-enter Stripe keys for a normal update.

When you are done

Every WordPress install you control that had Forminator now shows 1.57.1 or newer. Staging matches production. You are not hunting CVE strings in the dashboard. You needed the August 18 security floor on top of the July upload fix. You have it. Close the tab.