CVE-2026-15748: Critical Forminator WordPress RCE — Detection, Hunting, and Remediation Guide

---
title: Webshell Execution Attempt via PHP Request in WordPress Uploads Directory
id: 3f8c1a2e-7b94-4d51-9e6a-2c5f8d0b1a73
status: experimental
description: Detects HTTP requests to PHP files located in WordPress uploads directories, consistent with execution of a malicious file uploaded via CVE-2026-15748 (Forminator arbitrary PHP upload). Uploaded content in wp-content/uploads should never be directly executable PHP.
references:
  - https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: webserver
detection:
  selection_uri:
    c-uri|contains:
      - '/wp-content/uploads/'
    c-uri|endswith:
      - '.php'
      - '.phtml'
      - '.php3'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection_uri
falsepositives:
  - Rare legitimate plugins that serve PHP from upload paths (non-standard and discouraged)
level: high
---
title: PHP-FPM or Web Server Spawning Shell or Reconnaissance Commands
id: 9b2e4f71-1c38-4a67-b5d2-8e0f3a6c9152
status: experimental
description: Detects the web server or PHP-FPM worker process spawning shells, downloaders, or reconnaissance binaries — a strong post-exploitation indicator following webshell deployment via CVE-2026-15748.
references:
  - https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'php-fpm'
      - 'php'
      - 'apache2'
      - 'httpd'
      - 'nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - WordPress cron or backup plugins invoking system commands (rare; investigate per-host)
  - Legitimate admin scripts run under the web user
level: high
---
title: Suspicious Multipart Upload to WordPress AJAX Endpoint for Forminator
id: 6d1a8c40-2f75-4e98-a3b1-7c9d2e5f0486
status: experimental
description: Detects POST requests to admin-ajax.php referencing Forminator upload actions, the expected initial access vector for CVE-2026-15748 exploitation. Tune to alert on requests originating from known-bad or non-typical geographies, or elevated volume.
references:
  - https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/14
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    c-uri|contains: '/wp-admin/admin-ajax.php'
  selection_method:
    c-method: 'POST'
  selection_action:
    cs-uri-query|contains:
      - 'forminator'
      - 'action=forminator'
  condition: selection_endpoint and selection_method and selection_action
falsepositives:
  - Legitimate form submissions by site visitors (expect high volume on active sites — use as enrichment/context, not a standalone alert, or threshold by source IP)
level: medium

// Hunt for webshell execution: requests to PHP files under wp-content/uploads
// Works against WAF/reverse-proxy logs ingested via CEF (CommonSecurityLog) or IIS/Apache logs
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL contains "/wp-content/uploads/"
| where RequestURL has_any (".php", ".phtml", ".php3", ".php5", ".php7", ".phar")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, RequestURL, RequestMethod, DeviceAction
| order by FirstSeen asc
;
// Correlate: POSTs to Forminator upload handler followed by GET to a new .php in uploads
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL contains "admin-ajax.php" and RequestMethod =~ "POST"
| where AdditionalExtensions has "forminator" or RequestURL has "forminator"
| summarize UploadAttempts = count(), Sources = make_set(SourceIP, 20) by TimeGenerated, DestinationHostName
| order by TimeGenerated desc
;
// Endpoint-side: web server or PHP-FPM spawning suspicious child processes (Defender for Endpoint on Linux servers)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("php-fpm", "php", "apache2", "httpd", "nginx")
| where FileName has_any ("sh", "bash", "curl", "wget", "nc", "ncat", "python", "python3", "perl", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for PHP files written into WordPress uploads directories (potential webshells from CVE-2026-15748)
-- Adjust the base path glob to your hosting layout (e.g., /var/www/*/wp-content/uploads/)
LET upload_roots = glob(glob='/var/www/*/wp-content/uploads/')

SELECT FullPath,
       Size,
       Mtime,
       Btime,
       Mode
FROM glob(globs='/var/www/**/wp-content/uploads/**/*.php',
          accessor='file')
ORDER BY Mtime DESC

#!/bin/bash
# CVE-2026-15748 - Forminator Forms emergency response script
# Run on each affected WordPress host (Linux). Requires wp-cli for version check/removal.
# Usage: bash forminator_cve_2026_15748_response.sh [WP_PATH]

WP_PATH="${1:-/var/www/html}"
REPORT="forminator_triage_$(date +%Y%m%d_%H%M%S).log"

echo "=== CVE-2026-15748 Forminator Response - $(hostname) - $(date) ===" | tee "$REPORT"

# 1. Check if Forminator is installed and get the version
if command -v wp >/dev/null 2>&1; then
  echo "[+] Checking Forminator version via wp-cli..." | tee -a "$REPORT"
  sudo -u www-data wp --path="$WP_PATH" plugin list --format=table 2>/dev/null | grep -i forminator | tee -a "$REPORT"
else
  echo "[!] wp-cli not found; checking plugin directory directly." | tee -a "$REPORT"
  grep -h "Version:" "$WP_PATH/wp-content/plugins/forminator/forminator.php" 2>/dev/null | tee -a "$REPORT"
fi

# 2. EMERGENCY MITIGATION: deactivate Forminator until patched version is confirmed
echo "[+] Deactivating Forminator pending patch..." | tee -a "$REPORT"
sudo -u www-data wp --path="$WP_PATH" plugin deactivate forminator 2>/dev/null | tee -a "$REPORT"

# 3. HUNT: find PHP/executable script files inside uploads tree (webshell indicator)
echo "[+] Scanning uploads for executable script files..." | tee -a "$REPORT"
find "$WP_PATH/wp-content/uploads" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php*' \) -printf '%T@ %Tc %p\n' 2>/dev/null | sort -rn | head -100 | tee -a "$REPORT"

# 4. HUNT: recently modified files across the site (last 14 days)
echo "[+] Files modified in the last 14 days under webroot..." | tee -a "$REPORT"
find "$WP_PATH" -type f -mtime -14 -name '*.php' -printf '%T@ %Tc %p\n' 2>/dev/null | sort -rn | head -100 | tee -a "$REPORT"

# 5. HUNT: unauthorized WordPress admin users
echo "[+] Enumerating administrator accounts..." | tee -a "$REPORT"
sudo -u www-data wp --path="$WP_PATH" user list --role=administrator --format=table 2>/dev/null | tee -a "$REPORT"

# 6. HARDEN: block PHP execution in uploads via .htaccess (Apache) - verify nginx equivalent separately
HTACCESS="$WP_PATH/wp-content/uploads/.htaccess"
if [ ! -f "$HTACCESS" ]; then
  echo "[+] Deploying PHP execution block in uploads..." | tee -a "$REPORT"
  cat > "$HTACCESS" <<'EOF'
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
  Require all denied
</FilesMatch>
EOF
  chown --reference="$WP_PATH/wp-content/uploads" "$HTACCESS" 2>/dev/null
fi

echo "=== Triage complete. Review $REPORT, then update Forminator to the latest patched release. ===" | tee -a "$REPORT"