The vulnerability in the Forminator Forms plugin allows unauthenticated attackers to upload arbitrary files through a public submission handler. The upload mechanism fails to enforce proper MIME type validation, enabling the bypass of the blocklist with pipe‑alternative MIME types and injection of forged upload field configurations via a manipulated Select field value. The resulting arbitrary file upload can include executable code, giving attackers the ability to run commands on the WordPress host and compromising confidentiality, integrity, and availability of the site.

WordPress sites that use the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin from wpmudev, in any version up to and including 1.56.1.

The CVSS score of 9.8 indicates critical severity, and the lack of authentication requirements means any visitor can exploit the flaw. While an EPSS score is not available, the absence of a KEV listing does not diminish the risk; the flaw is already functional in production environments. An attacker crafts a form submission with a forged field configuration, triggers the handle_file_upload function, and uploads a malicious file to a directory accessible to the server, then re‑triggers processing to achieve remote code execution.