{"uuid": "de22dff9-ccc2-4a23-aadf-60a849f227b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/pphm_HackerNews/2692", "content": "\ud83d\udd34 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\n\nA critical vulnerability in the Forminator Forms plugin for WordPress potentially exposes thousands of websites to remote code execution (RCE), WordPress security firm Defiant warns.\n\nTracked as CVE-2026-15748 (CVSS score of 9.8), the bug is described as an arbitrary file upload via the handle_file_upload function of the popular form builder plugin.\n\nInsufficient file type validation in the affected function allows unauthenticated attackers to upload executable files, leading to code execution.", "creation_timestamp": "2026-08-21T23:00:05.500746Z"}