SecBriefs
← All briefs

A Forminator flaw may expose 300,000 WordPress sites to remote takeover

A malicious upload could lead to code execution without a valid account.

Hand-drawn SecBriefs editorial illustration: A Forminator flaw may expose 300,000 WordPress sites to remote takeoverSOURCE · SecurityWeek
© 2026 SecBriefs · Original illustration

THE BRIEF

A critical weakness in the Forminator WordPress plugin can allow an unauthenticated attacker to upload a malicious PHP file and execute code on a vulnerable website. Around 300,000 installations may be exposed.

WHY IT MATTERS

A compromised WordPress site can be turned into a phishing page, malware host or doorway to customer and administrative data. Public exploit interest can turn a plugin flaw into broad automated scanning very quickly.

WHO SHOULD CARE

WordPress owners, agencies, hosting providers and teams responsible for public marketing sites.

WHAT TO DO NOW

  • Install the fixed Forminator release immediately.
  • Search for unexpected PHP files, new administrators and modified templates.
  • Remove unused plugins and restrict file execution where possible.

VERIFICATION NOTE

Source basis: SecurityWeek reporting. Exposure estimates describe installations, not confirmed compromises.

Read original at SecurityWeek

SecBriefs adds context and practical guidance. Reporting remains credited and linked to the original publisher.