CVE-2026-15748

CVE-2026-15748 in the Forminator WordPress plugin is being classified as arbitrary file upload with a CVSS 9.8, but the vulnerability's significance extends far beyond the blocklist bypass technique that earned it a score. The exploitation chain's first link reveals the real problem: attackers don't target the upload function directly. They inject upload configuration through a form submission by forging a Select field value. This transforms a legitimate feature—allowing form builders to configure upload fields per-form—into the exploitation vector itself. The submission handler trusts attacker-controlled configuration, which then feeds into the upload handler with parameters the developer never intended to be publicly settable. This is a trust boundary violation wearing the mask of a feature. The blocklist bypass using alternate MIME type keys is technically interesting but secondary. Blocklist approaches have a long history of bypass techniques—double extensions, null bytes, case manipulation, and now this. The deeper problem is that a blocklist exists at all in a context where public input can override it. A properly designed upload handler wouldn't rely on client-supplied type hints; it would validate against an allowlist derived from server-side configuration. If the patch only expands the blocklist, the underlying architectural flaw survives intact. This pattern—drawing dynamic configuration from submission-time request data instead of server-side stored definitions—is an abstraction leak that has a documented history across PHP applications, CMS plugins, and web frameworks. It appears in OWASP guidance and plugin security audit checklists. The relevant question isn't how this specific abstraction leak happened, but why the team didn't catch it given the pattern's visibility. The fix isn't merely server-side validation of the configuration namespace—it requires treating the configuration namespace as a security surface requiring explicit allowlisting, not implicit trust. If this plugin draws dynamic configuration from submission-time data in one handler, that pattern likely exists elsewhere. Trust boundary violations at the architectural level don't tend to be isolated; they reflect a mental model applied consistently across features. The EPSS of 0.01177 suggests this isn't weaponized yet, but that measures weaponization velocity, not footprint. A plugin with this install base and this vulnerability class is a ticking radius-expansion event. Publication collapses the sophistication window—once someone documents the form structure and configuration injection mechanism, mass exploitation follows. Prioritize patching not just this CVE, but audit the plugin for other handlers that may share the same trust assumption.

Reviewed through automated stages and approved by a human before publication.