CVE-2026-15748

{
  "etk_id": "ETK-2026-1518",
  "cve_id": "CVE-2026-15748",
  "display_id": "CVE-2026-15748",
  "ghsa_id": "GHSA-3p88-69p6-f6mj",
  "euvd_id": "EUVD-2026-60569",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated arbitrary file upload in Forminator Forms",
  "summary": "Forminator Forms for WordPress versions through 1.56.1 inadequately restrict uploaded file types. An unauthenticated attacker may upload a potentially executable file and could obtain code execution if a publicly reachable form submission path is available.",
  "mitigation": "Update Forminator Forms to version 1.56.2 or later. Until the update is applied, disable or restrict public forms that accept uploads and prevent uploaded files from being executed by the web server.",
  "vendor": "incsub",
  "product": "Forminator",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.56.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0614,
  "epss_percentile": 0.9339,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 47.18890605,
  "t0_at": "2026-08-18T05:31:20.458000+00:00",
  "signals": {
    "kev": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 56,
      "is_lower_bound": false,
      "measured_at": "2026-08-18T05:31:20.458000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-15748"
    },
    "public_poc": {
      "at": "2026-08-18T14:44:00+00:00",
      "days": 0.38379099537037037,
      "is_lower_bound": false,
      "measured_at": "2026-08-18T05:31:20.458000+00:00",
      "url": "https://github.com/yora1928/cve-2026-15748"
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 55.76990210648148,
      "is_lower_bound": false,
      "measured_at": "2026-08-18T05:31:20.458000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-15748"
    }
  }
}