Popular WordPress Plugin Flaw Exposes Hundreds of Thousands of Sites to Complete Takeover

A Major Security Problem in WordPress Forms

Security researchers have uncovered a serious vulnerability in Forminator, a WordPress plugin trusted by more than 600,000 websites worldwide. This flaw, identified as CVE-2026-15748, allows attackers to execute malicious code directly on affected websites without permission. Think of it like discovering an unlocked back door in a storefront that millions of businesses are using—attackers can simply walk in and take what they want.

The vulnerability has earned a severity rating of 9.8 out of 10.0, placing it in the critical category. This is not a minor issue that can wait for a convenient update window. The flaw is straightforward enough for even moderately skilled attackers to exploit, making this a genuine emergency for site owners who rely on this plugin.

How Attackers Are Sneaking In

What makes this particularly concerning is how attackers are disguising their activities. Security teams have identified that threat actors are using two common internet technologies—DNS queries and Google Apps Script—to hide their malicious behavior within normal network traffic. Imagine a criminal walking through an airport wearing a uniform identical to security staff; they blend right in and nobody notices.

DNS is the system that translates website addresses into the numbers computers need to communicate. Google Apps Script is a legitimate tool that millions of businesses use for automation. By routing their attack commands through these normal channels, hackers make their activities appear routine to security monitoring systems, making detection significantly harder.

What This Means

If your website runs WordPress and uses the Forminator plugin, you are potentially exposed to complete system compromise. An attacker exploiting this flaw could:

• Install hidden malware that steals visitor information
• Redirect users to malicious websites
• Harvest customer data, including payment information
• Take control of your entire website and its content
• Use your site as a launching point for attacks on others

This isn't theoretical—attackers are actively exploiting this vulnerability right now.

Why You Should Care

If you operate a WordPress site, this demands immediate attention. Website compromise doesn't just damage your reputation; it exposes your customers' personal information to theft. You could face legal liability, lose customer trust, and incur significant recovery costs. Even small businesses and nonprofits are targets because their security often lags behind larger organizations.

The combination of widespread installation numbers and critical severity creates a perfect storm for attackers seeking quick access to thousands of websites simultaneously.

Beyond individual website owners, this vulnerability threatens the entire ecosystem. When hundreds of thousands of sites become compromised gateways, it enables large-scale attacks across the internet.

What You Can Do

• Check immediately: Log into your WordPress admin panel and verify if Forminator is installed
• Update right away: Apply the security patch as soon as your plugin developer releases it
• If patching is delayed: Temporarily deactivate the plugin until a fix is available
• Monitor your site: Watch for unusual activity, unexpected user accounts, or suspicious file changes
• Strengthen passwords: Update all WordPress admin credentials to complex, unique passwords
• Enable security tools: Install a WordPress security plugin that monitors for intrusions

Time is critical—treat this as a security emergency rather than a routine maintenance task.