An arbitrary file upload vulnerability in the Forminator Forms plugin allows unauthenticated attackers to achieve remote code execution by bypassing file extension validation.

The vulnerability exists in the handle_file_upload function, where insufficient validation allows attackers to bypass blocklists using alternative MIME type keys, enabling the upload of executable files.

The ability for an unauthenticated attacker to execute arbitrary code on the server represents a total compromise of the affected WordPress instance. With a CVSS score of 9.8, this flaw could lead to complete system takeover, site defacement, and the installation of persistent backdoors or malware.

Immediate Action: Update the Forminator Forms plugin to the latest available version beyond 1.56.1. If no patch is available, immediately deactivate and remove the plugin until a secure version is released.

Proactive Monitoring: Review web server logs for suspicious POST requests to the plugin upload handlers and monitor the uploads directory for unexpected file types or executable scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious file uploads and restrict access to common plugin entry points.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability is of critical severity and requires immediate attention to prevent full server compromise. Administrators must verify if an update is available and apply it immediately or disable the plugin to maintain the security posture of the WordPress site.