Why 600,000 WordPress Sites Were One Form Field Away From Being Hijacked

Picture the careers page on your website. There is a form on it. It asks a candidate to pick the role they are applying for from a dropdown, and to upload their CV. Standard stuff. Nearly every SME site in the country has some version of it.

That exact combination of fields, a file upload sitting next to a dropdown, was the trigger condition for a flaw that put around 600,000 WordPress sites at risk this summer. The plugin is called Forminator. If you built your site on WordPress two or three years ago and have not touched it since, there is a fair chance it is running on yours.

Nothing in this post is designed to make you feel foolish for having it. Forminator is one of the most popular form plugins in the world for a reason. It is, however, a decent excuse to talk about a question a lot of business owners never think to ask: if a flaw is found in something running on my website, how long is it going to take somebody to notice?

What actually went wrong

The technical name for the flaw is an unauthenticated stored cross-site scripting vulnerability, triggered via a forged upload record. In plain English: "unauthenticated" means the attacker does not need a login. "Stored" means their payload gets saved into your site's database and re-served to anyone who loads the affected page. "Cross-site scripting" means the payload is a piece of JavaScript that runs inside the visitor's browser as if it came from your site. The interesting case is when that visitor is one of your admins, logged into the WordPress dashboard. At that point the attacker's script is running with admin privileges, which is one short step from a new admin user being quietly added and the site changing hands.

The timeline: CVE-2026-18325

The flaw was reported to Forminator's developer on 14 July. It was acknowledged six days later on 20 July. A patched version, 1.56.2, was released on 31 July. Anything below that number is still vulnerable. On the standard CVSS severity scale it scored 7.2 out of 10, in the "high" band. It was disclosed via Wordfence's Bug Bounty programme.

That timeline reads like a system working as intended. A flaw was found. A fix went out. Move on.

The problem is that a fix only helps the sites where somebody actually installs it. And publishing a fix is the exact moment attackers find out where to look.

In April this year the Ninja Forms File Uploads add-on had a worse variation of the same theme disclosed: a genuine unauthenticated arbitrary file upload leading to remote code execution, scoring 9.8 out of 10. The patch had quietly been available since 19 March. Public disclosure was 7 April. Attackers began exploiting sites the same day. The three weeks in between were the whole ballgame. Public disclosure is the starting gun. It is not the all-clear.

This is not really a Forminator problem

WordPress has around 60,000 plugins in its official repository. A typical small business site runs somewhere between 20 and 30 of them. Every single one is a piece of code written and maintained by somebody you have never met. Somewhere in that pile, at any given moment, there is a flaw that nobody has spotted yet.

Using plugins is not the mistake. There is no realistic way to build a modern WordPress site without them. The mistake is not watching them.

Why Forminator is not on our shortlist

For context, this is why Forminator is not one of the plugins we reach for when we build a WordPress site. There was a serious file upload vulnerability in 2023. Another one at version 1.28.1. A stored cross-site scripting flaw in February this year. And now this.

That is not snobbery. Forminator is popular because it genuinely does the job well, and a large install base attracts more researchers, which is broadly good for the ecosystem. But when we are picking the plugin that will run a client's lead pipeline for the next three years, "does it work" is not the only question we ask. "Has this exact class of critical flaw come up more than once, and does the release history suggest another one is likely?" is another. On that one, we tend to reach for something else.

What happened at our end

The Wordfence advisory landed in the inbox on a Thursday morning. We keep a running inventory of every plugin, theme and version installed on every client site we look after. Cross-reference the affected plugin against that list, zero matches, close the tab. Twenty minutes.

If we had found a match, the sequence would have been: pull the site into staging, back it up, apply the patched version, sanity-check that nothing has broken, look at the uploads directory and the user table for anything that should not be there, and email the client before they had a chance to hear about it from anyone else. None of that is clever work. It is just the work.

The quiet hero of that story is the inventory. Most sites do not have one, and that is why "are we affected" turns into a fortnight-long question instead of a twenty-minute one. We have written before about what ongoing support actually covers. Keeping that inventory current is one of the least visible parts of it and one of the most useful.

How to check your own site in about a minute

If you want to check whether your own site is at risk right now, this is not complicated. Log into your WordPress admin area and open the Plugins screen. Find Forminator in the list. Look at the version number underneath the name. Anything below 1.56.2 is the vulnerable version and needs updating. If it is 1.56.2 or higher, you are fine on this specific flaw.

While you are there, click into Forminator itself and look at your forms. The specific trigger condition was any single form that included both a file upload field and a dropdown. If any of your forms have that combination and you were running an unpatched version at any point since 14 July, treat the site as if it may have been touched. Because this particular flaw lets attackers run JavaScript inside a logged-in admin's browser, check the Users screen for any admin account you do not recognise, and skim your recent Forminator submissions for entries that contain obvious script payloads or unfamiliar URLs sitting where a file name should be.

We are giving that check away with no form to fill in on purpose. It is more useful to you than another lead magnet, and if you find something worrying we would rather you tell us second than tell nobody.

One quick note on Wordfence, since a lot of readers have it installed and assume that means they are protected on day one. Premium subscribers get new firewall rules for critical flaws like this immediately. Free users get the same rule 30 days later. That is not a criticism, it is how the product works, but "we have Wordfence installed" is not the same thing as "we are covered today".

What a support plan actually buys you

Most of the time a support plan looks like it is doing nothing. That is the product. It is a small monthly arrangement with somebody whose job is to notice things before you have to. Sometimes that means applying a patch on a Sunday morning for a flaw the client will never hear about. Sometimes it means opening an email, checking a list, and closing the tab.

If you are not sure what your WordPress site is running, or when any of it was last touched, send us the URL and we will take a look. No form, no obligation. If you are fine, we will tell you.