{"vulnerability": "cve-2026-15748", "sightings": [{"uuid": "c8d144e5-c68c-43c9-b52b-156e1a4fbfd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117116485016843298", "content": "It is possible to see elevated activities targeting WPMU DEV Forminator Forms Plugin (CVE-2026-15748) https://vuldb.com/vuln/391522/cti", "creation_timestamp": "2026-08-18T12:22:20.998475Z"}, {"uuid": "98ab8188-dda8-488d-a80f-4f492097be08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mte7mlga4k23", "content": "\u26a0\ufe0f PATCH NOW\n\nForminator, a WordPress form plugin on 600,000+ sites, has a critical flaw: a stranger can upload a PHP file and run code, no login needed.\n\nAffects versions up to 1.56.1. Fix: update to 1.56.2 now. (CVE-2026-15748)", "creation_timestamp": "2026-08-18T12:26:24.813539Z"}, {"uuid": "6968565b-a91a-4b08-b9e4-579a6e922674", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mtils6sf2w2j", "content": "CVE-2026-15748: Critical Forminator WordPress Flaw Enables Unauthenticated RCE\n\n", "creation_timestamp": "2026-08-20T06:15:07.334980Z"}, {"uuid": "de22dff9-ccc2-4a23-aadf-60a849f227b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/pphm_HackerNews/2692", "content": "\ud83d\udd34 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\n\nA critical vulnerability in the Forminator Forms plugin for WordPress potentially exposes thousands of websites to remote code execution (RCE), WordPress security firm Defiant warns.\n\nTracked as CVE-2026-15748 (CVSS score of 9.8), the bug is described as an arbitrary file upload via the handle_file_upload function of the popular form builder plugin.\n\nInsufficient file type validation in the affected function allows unauthenticated attackers to upload executable files, leading to code execution.", "creation_timestamp": "2026-08-21T23:00:05.500746Z"}, {"uuid": "b9b9400f-d5f3-40c7-85c7-79c2d97469a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/pphm_HackerNews/2692", "content": "\ud83d\udd34 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\n\nA critical vulnerability in the Forminator Forms plugin for WordPress potentially exposes thousands of websites to remote code execution (RCE), WordPress security firm Defiant warns.\n\nTracked as CVE-2026-15748 (CVSS score of 9.8), the bug is described as an arbitrary file upload via the handle_file_upload function of the popular form builder plugin.\n\nInsufficient file type validation in the affected function allows unauthenticated attackers to upload executable files, leading to code execution.", "creation_timestamp": "2026-08-22T00:00:09.246778Z"}, {"uuid": "23fc81d4-f631-46a9-84ee-3acdeff5a95c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mtcisrxz2p2u", "content": "\ud83e\udd16 CVE-2026-15748 (CVSS 9.8): unauthenticated RCE in Forminator, a WordPress forms plugin with 600k+ active installs. Malicious PHP uploads allow arbitrary code execution.\nhttps://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html", "creation_timestamp": "2026-08-17T20:05:36.573623Z"}, {"uuid": "156651a9-bfd4-4328-aebe-e4001b6a8f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "content": "", "creation_timestamp": "2026-08-19T00:00:27.153894Z"}, {"uuid": "eb527c3c-e019-4b61-8a26-f9e72e15e68a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/ZxcQ6RVn-5sFAZ4qkLho0f4GJRaaxyJWc-8e0k9Lah5Vjrw", "content": "", "creation_timestamp": "2026-08-19T00:00:27.220991Z"}, {"uuid": "ccf10544-b1b0-40bc-a999-35a59f4a77d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html", "content": "A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.\n\nThe vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias \"", "creation_timestamp": "2026-08-17T22:00:44.218649Z"}, {"uuid": "d40ffc29-705b-43aa-b553-2409cc28432f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mtjt756o2a2r", "content": "\ud83d\udce2 CVE-2026-15748 : Faille critique dans Forminator Forms expose 300 000 sites WordPress\n\nL'information provient de la firme de s\u00e9curit\u00e9 WordPress Defiant. \ud83d\udd0d Contexte Une vuln\u00e9rabilit\u00e9 critique a \u00e9t\u00e9 identifi\u00e9e dans le plugin\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#ForminatorForms #WordPress #Cyberveille", "creation_timestamp": "2026-08-20T18:00:07.017629Z"}, {"uuid": "10332304-36d7-400d-838e-05b25e2a6ea2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html", "content": "A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.\n\nThe vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias \"", "creation_timestamp": "2026-08-18T01:00:32.616351Z"}, {"uuid": "b33d9fc7-929f-4e0f-96b2-6f2b79f923c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mtd46haxse2b", "content": "CVE-2026-15748 (CVSS 9.8): Forminator Flaw Enables Pre-Auth RCE", "creation_timestamp": "2026-08-18T01:52:09.501083Z"}, {"uuid": "116e6a94-5c9b-4669-bea3-febbdabb672d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "Telegram/yVQLpMg2DCmEsahM2p8kyXYCXocCayarh_UcNeEOoo7GmA", "content": "", "creation_timestamp": "2026-08-19T23:00:04.929147Z"}, {"uuid": "26daeded-33ec-4c02-a4dc-a4eadb077265", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/z3usalmighty.bsky.social/post/3mtm2midgcc2n", "content": "With 600,000 active installs, a 9.8 unauthenticated RCE in Forminator is a third-party supply issue, not routine plugin hygiene. CVE-2026-15748 reaches code execution through malicious PHP uploads with no authentication. Patch before scan traffic finds it.\n\n#CyberSecurity #DataStrategy", "creation_timestamp": "2026-08-21T15:18:10.499046Z"}, {"uuid": "593b2d4b-f94c-41c6-b69a-619e19b0fe80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/Hnh5kvBiZ07q02Wzarvcrlnf48Y4Gt3kSaOKhn6LmktH_wo", "content": "", "creation_timestamp": "2026-08-18T04:00:03.726472Z"}, {"uuid": "c7129aa7-8453-42bf-b789-6696451ed78e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/ZxcQ6RVn-5sFAZ4qkLho0f4GJRaaxyJWc-8e0k9Lah5Vjrw", "content": "", "creation_timestamp": "2026-08-18T04:00:03.829201Z"}, {"uuid": "283e533e-c921-41b9-9ae8-3506bf29fd72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/yVQLpMg2DCmEsahM2p8kyXYCXocCayarh_UcNeEOoo7GmA", "content": "", "creation_timestamp": "2026-08-20T00:00:06.955776Z"}, {"uuid": "afd2d59a-3d35-4e79-95bc-766676bb5c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-15748", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mtfxx7avej2q", "content": "Critical WordPress Alert: Dissecting CVE-2026-15748 (Forminator RCE) & CVE-2026-15826 (UPB Auth\u00a0Bypass)\n\nCVE-2026-15748 enables critical Forminator RCE, while CVE-2026-15826 allows User Profile\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-15748-forminator-rce-cve-2026-15826-user-profile-builder/", "creation_timestamp": "2026-08-19T05:14:30.821942Z"}, {"uuid": "e18a0c5d-a92a-4e97-a5c7-93e47861cd65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-15748", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtdk2ing2c2t", "content": "wpmudev Forminator Forms (\u22641.56.1) faces CRITICAL CVE-2026-15748: Arbitrary file upload flaw enables unauthenticated RCE. Restrict uploads and patch ASAP. https://radar.offseq.com/threat/cve-2026-15748-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-wpmudev-forminator-forms-087a3235e4a...", "creation_timestamp": "2026-08-18T06:00:29.960922Z"}, {"uuid": "715d7f8e-edef-4ec4-9469-ac25accea103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtdmbc4euy2p", "content": "CVE-2026-15748\nThe Forminator Forms plugin for WordPress is affected by a security risk that allows attackers to upload any file, potentially including executable code. This could allow an attacker to take control of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-18T06:40:04.441774Z"}, {"uuid": "2c6badc8-5bbd-4596-8e9a-e3057e5a5ea4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fmiec6bhim5im", "content": "CVE-2026-15748 - Forminator Forms\nCVE ID : CVE-2026-15748\n \n Published : Aug. 18, 2026, 6:16 a.m. | 19\u00a0minutes ago\n \n Description : The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file...", "creation_timestamp": "2026-08-18T06:46:06.081603Z"}, {"uuid": "81480c20-2e46-4465-b942-24b996888b11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mtdnawehqo2m", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3Forminator\u306b\u8106\u5f31\u6027\u3002\u5168\u30d0\u30fc\u30b8\u30e7\u30f3\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u30bf\u30a4\u30d7\u691c\u8a3c\u4e0d\u5099\u306b\u3088\u308a\u3001\u8a8d\u8a3c\u306a\u3057\u3067\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u304c\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3055\u308c\u3001\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u53ef\u80fd\u6027\u304c\u3042\u308b\u3002\nCVE-2026-15748 CVSS 9.8 | CRITICAL", "creation_timestamp": "2026-08-18T06:57:45.636638Z"}, {"uuid": "55b60971-0431-44e1-95b9-28511dc93106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mtg5u2ou532w", "content": "\ud83d\udce2 [VULN] 600 000 sites WordPress menac\u00e9s par une faille critique dans Forminator Forms CVE-2026-15748\n\nUne faille critique touche Forminator Forms, une extension WordPress utilis\u00e9e sur plus de 600 000 sites.\n\n#Vuln\u00e9rabilit\u00e9 #CVE #Cyberveille", "creation_timestamp": "2026-08-19T07:00:07.447068Z"}, {"uuid": "c27e9fd0-62e4-4727-91d2-4ff75559de68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtdr4w5twb25", "content": "\ud83d\udea8 CVE-2026-15748 \u2014 CVSS 9.8 CRITICAL\n\nThe Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-15748\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T08:07:06.456024Z"}, {"uuid": "ad54adff-6016-4dba-9c2c-b3064f021ad0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mtdu47zym62x", "content": "Nieuw ernstig beveiligingslek in populaire WordPress-plugin Forminator Forms maa\n\nEen kritiek beveiligingslek, aangeduid als CVE-2026-15748, is ontdekt in de Forminator Forms WordPress-plugin, dat versies 1.56.1 en ouder treft. Met een CVSS-score van 9.8 vormt dit een zeer ernstig risico voo...", "creation_timestamp": "2026-08-18T09:00:24.858014Z"}, {"uuid": "ac356aac-c635-4934-a3a6-9ddd69385ae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/CEB9a3fsP7fSaxevWc1FrPk_BMOnlKevVAjnT4jZ0NlsXCc", "content": "", "creation_timestamp": "2026-08-20T03:00:04.972107Z"}, {"uuid": "db85efcf-c366-4869-9e22-f6a96d5ff98c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/OE_j0lkcu_hy0tneu4LVEJjjSEMhrw6Me4lFPRcw_L7UUOA", "content": "", "creation_timestamp": "2026-08-20T03:00:04.726602Z"}, {"uuid": "74afc4a9-bde3-42f8-8e6d-89be80f3fbee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "Telegram/dEOxkW7Fjs9kyJNCqqh8nNQclw4OnMEUeVB0uRmPUXS8-vI", "content": "", "creation_timestamp": "2026-08-20T03:00:05.652126Z"}, {"uuid": "b98acca3-e56e-4f66-a30b-cffc605c2f15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "Telegram/YhnkSZ4tbMRdQufIiZvcwasUc0b4Wppo8LaewhbAXBk7v5k", "content": "", "creation_timestamp": "2026-08-20T03:00:05.741619Z"}, {"uuid": "a1f81447-1fd6-4406-aaf0-9dd6bf8f3f5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "Telegram/ZdYOxyFIATdPFxnlNJg5JA21M33sERAxplIOqa6OrE983o0", "content": "", "creation_timestamp": "2026-08-20T03:00:05.781200Z"}, {"uuid": "1dd48864-2313-46ce-8cfb-d8727e7d4ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/YhnkSZ4tbMRdQufIiZvcwasUc0b4Wppo8LaewhbAXBk7v5k", "content": "", "creation_timestamp": "2026-08-21T00:00:10.442692Z"}, {"uuid": "ad37d083-9325-4d75-861b-e8eb947d1560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/fredyavila2.bsky.social/post/3mtic3z5akc2g", "content": "M\u00e1s de 600.000 sitios WordPress en riesgo: qu\u00e9 debemos saber sobre la vulnerabilidad CVE-2026-15748 www.disoftin.com/2026/08/mas-...", "creation_timestamp": "2026-08-20T03:21:29.841617Z"}, {"uuid": "98ebb279-56d6-4ce1-b5ad-7eaa1608d8b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/ZdYOxyFIATdPFxnlNJg5JA21M33sERAxplIOqa6OrE983o0", "content": "", "creation_timestamp": "2026-08-21T00:00:10.344350Z"}, {"uuid": "1a8f3da4-da6c-4803-b37b-bb9a9e35c346", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/dEOxkW7Fjs9kyJNCqqh8nNQclw4OnMEUeVB0uRmPUXS8-vI", "content": "", "creation_timestamp": "2026-08-21T00:00:10.725246Z"}, {"uuid": "86ce57ca-112b-4643-a0af-8935986ad4e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/cyberthreats.bsky.social/post/3mte4iqn4572p", "content": "300K WordPress sites at risk from CVE-2026-15748 \u2014 a critical file upload flaw letting unauthenticated attackers run malicious code. Patch your form plugins now. \u26a0\ufe0f #cybersecurity #infosec #CVE #WordPress Read more -> cyberthreats247.com", "creation_timestamp": "2026-08-18T11:30:34.581751Z"}, {"uuid": "e640ee52-56c9-417a-ace3-fb1a15dc95eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/OE_j0lkcu_hy0tneu4LVEJjjSEMhrw6Me4lFPRcw_L7UUOA", "content": "", "creation_timestamp": "2026-08-21T00:00:19.647268Z"}, {"uuid": "6b930fcd-1d8a-466e-a5d7-cc929331c039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/CEB9a3fsP7fSaxevWc1FrPk_BMOnlKevVAjnT4jZ0NlsXCc", "content": "", "creation_timestamp": "2026-08-21T00:00:19.882762Z"}, {"uuid": "3d4e4b15-aff0-42cc-b790-7520f51df8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/GithubRedTeam/98634", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-15748\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yora1928\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 15:01:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-15748 - Unauthenticated RCE exploit for WordPress Forminator plugin (\u22641.56.1). Automated detection, deep crawl, nonce extraction, and safe upload test. For authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-22T19:00:06.926908Z"}, {"uuid": "607abef5-186f-4973-86e3-009699670b63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/information_security_channel/55760", "content": "300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\nhttps://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/\n\nTracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files.\nThe post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw (https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-08-22T19:00:10.276188Z"}, {"uuid": "d61ba96c-28a3-42d2-93b4-87f4bf34d0fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mtoz757ms223", "content": "Alert: A critical flaw (CVE-2026-15748, CVSS 9.8) in WordPress Forminator Forms (60k+ installs) could allow remote code execution. Update now to protect your site!", "creation_timestamp": "2026-08-22T19:30:48.082063Z"}, {"uuid": "2148592f-312c-4ff6-a118-b77b25f4f3a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/98634", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #Exploit #CVE #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-15748\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a yora1928\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-18 15:01:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-15748 - Unauthenticated RCE exploit for WordPress Forminator plugin (\u22641.56.1). Automated detection, deep crawl, nonce extraction, and safe upload test. For authorized testing only.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-23T00:00:07.959375Z"}, {"uuid": "1c901f31-2a0a-4a1c-854d-328fe6bdc8fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/information_security_channel/55760", "content": "300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\nhttps://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/\n\nTracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files.\nThe post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw (https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-08-23T00:00:33.730199Z"}, {"uuid": "4009b273-77f0-457f-b139-a4fc24b7d482", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/484", "content": "", "creation_timestamp": "2026-08-25T21:00:03.996070Z"}, {"uuid": "b580dd2b-2eee-42e8-8a74-cbf8f9f92c5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/captainsmok3r_official/483", "content": "CVE-2026-15748 - Forminator Forms Unauthenticated RCE", "creation_timestamp": "2026-08-25T21:00:04.035115Z"}, {"uuid": "3384e7ee-d31f-4a8b-ad42-1a010b6f5093", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/485", "content": "python poc-CVE-2026-15748.py -f list.txt --upload\n\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551   CVE-2026-15748 - Forminator Forms Unauthenticated RCE        \u2551\n\u2551   Crafted by Yora                                              \u2551\n\u2551   FOR EDUCATIONAL & AUTHORIZED TESTING ONLY                    \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\n[*] Targets: 5\n[*] Threads: 8\n[*] Upload test: ON\n[*] Crawl depth: 2\n\n[INSTALLED (unknown version)] https://workerspoint.pl v1.55.1 (folder) [44 pages]  [VULNERABLE] [93m[UPLOAD SKIP: no upload form]\n[INSTALLED (unknown version)] https://grprestige.online v1.57.1 (folder) [57 pages]  [PATCHED] [93m[UPLOAD SKIP: no upload form]\n[NOT FOUND] https://webgatorsolutions.com v1.55.1 (html-source) [76 pages]  [VULNERABLE] [UPLOAD SKIP: no upload form]\n[NOT FOUND] https://hafifbilgiler.com v1.57.1 (html-source) [102 pages]  [PATCHED]\n[NOT FOUND] https://eau.gouv.tg v1.48.2 (html-source) [104 pages]  [VULNERABLE] [93m[UPLOAD SKIP: no upload form]\n\n========== SUMMARY ==========\nVULNERABLE      : 3\nPATCHED         : 2\nUNKNOWN VERSION : 2\nNOT FOUND       : 3\nNOT WORDPRESS   : 0\nTOTAL SCANNED   : 5\n[+] HAVE UPLOAD FORM: 0\n\n[+] Hasil detail disimpan \u2192 scan_results_detailed.txt", "creation_timestamp": "2026-08-25T21:00:04.128722Z"}, {"uuid": "b1bd981b-245f-468c-a39a-9b296043c951", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/484", "content": "", "creation_timestamp": "2026-08-26T00:00:08.572739Z"}, {"uuid": "415f6c00-aedd-4a8e-8cce-af5e2c4ae9ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/captainsmok3r_official/483", "content": "CVE-2026-15748 - Forminator Forms Unauthenticated RCE", "creation_timestamp": "2026-08-26T00:00:08.602349Z"}, {"uuid": "5497d1d7-e248-4d7a-b603-c8865ac975e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/485", "content": "python poc-CVE-2026-15748.py -f list.txt --upload\n\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n\u2551   CVE-2026-15748 - Forminator Forms Unauthenticated RCE        \u2551\n\u2551   Crafted by Yora                                              \u2551\n\u2551   FOR EDUCATIONAL & AUTHORIZED TESTING ONLY                    \u2551\n\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n\n[*] Targets: 5\n[*] Threads: 8\n[*] Upload test: ON\n[*] Crawl depth: 2\n\n[INSTALLED (unknown version)] https://workerspoint.pl v1.55.1 (folder) [44 pages]  [VULNERABLE] [93m[UPLOAD SKIP: no upload form]\n[INSTALLED (unknown version)] https://grprestige.online v1.57.1 (folder) [57 pages]  [PATCHED] [93m[UPLOAD SKIP: no upload form]\n[NOT FOUND] https://webgatorsolutions.com v1.55.1 (html-source) [76 pages]  [VULNERABLE] [UPLOAD SKIP: no upload form]\n[NOT FOUND] https://hafifbilgiler.com v1.57.1 (html-source) [102 pages]  [PATCHED]\n[NOT FOUND] https://eau.gouv.tg v1.48.2 (html-source) [104 pages]  [VULNERABLE] [93m[UPLOAD SKIP: no upload form]\n\n========== SUMMARY ==========\nVULNERABLE      : 3\nPATCHED         : 2\nUNKNOWN VERSION : 2\nNOT FOUND       : 3\nNOT WORDPRESS   : 0\nTOTAL SCANNED   : 5\n[+] HAVE UPLOAD FORM: 0\n\n[+] Hasil detail disimpan \u2192 scan_results_detailed.txt", "creation_timestamp": "2026-08-26T00:00:08.692597Z"}, {"uuid": "788f3ccc-b929-4ae1-91ec-8e794e776126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/thehackernews/9821", "content": "\ud83d\udea8 Forminator flaw can give unauthenticated attackers RCE.\n\nCVE-2026-15748 affects 600,000+ active WordPress installs. On susceptible forms, attackers can upload malicious PHP files and potentially take over the site.\n\nRead: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html", "creation_timestamp": "2026-08-23T20:00:07.004647Z"}, {"uuid": "813c9a6d-c6f0-4c8d-bfe6-5f426a1aea9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9821", "content": "\ud83d\udea8 Forminator flaw can give unauthenticated attackers RCE.\n\nCVE-2026-15748 affects 600,000+ active WordPress installs. On susceptible forms, attackers can upload malicious PHP files and potentially take over the site.\n\nRead: https://thehackernews.com/2026/08/forminator-wordpress-flaw-can-enable.html", "creation_timestamp": "2026-08-24T00:00:04.336070Z"}, {"uuid": "dd65f4ec-7a12-4643-915d-25b43a45fe44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "seen", "source": "https://t.me/information_security_channel/55760", "content": "300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw\nhttps://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/\n\nTracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files.\nThe post 300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw (https://www.securityweek.com/300000-wordpress-sites-potentially-exposed-to-hacking-due-to-form-plugin-flaw/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-08-24T00:00:09.331907Z"}, {"uuid": "d83be287-e0c1-462a-be52-34dac16ac04e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/BjeVsXpYrNsRv6BrV8OD2OomoRwSN7YqQdY-9YF4AutvMEI", "content": "", "creation_timestamp": "2026-09-02T01:00:05.098185Z"}, {"uuid": "694571f3-b6a9-403b-8407-3f094bda64a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-15748", "type": "published-proof-of-concept", "source": "Telegram/BjeVsXpYrNsRv6BrV8OD2OomoRwSN7YqQdY-9YF4AutvMEI", "content": "", "creation_timestamp": "2026-09-03T00:01:00.291581Z"}]}