If your WordPress site runs Forminator 1.57.0, you are still inside the affected range for the latest critical Forminator vulnerability 2026 disclosure. CVE-2026-66583 is an unauthenticated PHP Object Injection flaw affecting Forminator versions up to and including 1.57.0. The current WordPress.org release is 1.57.1, which sits outside that affected range.
The version question is easy to misunderstand because CERT-In issued a separate critical Forminator warning on August 19 for CVE-2026-15748, an arbitrary file-upload vulnerability affecting versions before 1.56.2. That older issue was fixed in 1.56.2, but 1.56.2 is not the current safe endpoint for the newer CVE-2026-66583 issue.
Bottom line: if you use Forminator 1.57.0 or an older version, update to 1.57.1 or a later vendor-supported release. Do not stop at 1.56.2 merely because that version fixed the separate vulnerability highlighted by CERT-In.
Which versions are affected by the Forminator vulnerability 2026?
There are two separate vulnerabilities that WordPress site owners may encounter in current security warnings.
| Vulnerability | Affected versions | Main issue | Update position |
|---|---|---|---|
| CVE-2026-15748 | Versions before 1.56.2 | Unauthenticated arbitrary file upload with potential arbitrary code execution | 1.56.2 fixed this specific vulnerability |
| CVE-2026-66583 | Versions up to and including 1.57.0 | Unauthenticated PHP Object Injection | 1.57.1 is outside the affected range |
The second vulnerability is the reason a site owner should not assume that installing 1.56.2 is sufficient today.
Why does CERT-In mention Forminator 1.56.2?
CERT-In Vulnerability Note CIVN-2026-0414, issued on August 19, 2026, addresses CVE-2026-15748.
CERT-In says the vulnerability affects Forminator versions prior to 1.56.2 and arises from insufficient file-type validation in the plugin’s file-upload handling. According to the advisory, a remote unauthenticated attacker could exploit the vulnerable submission handler to upload arbitrary files, with successful exploitation potentially resulting in arbitrary code execution.
WordPress.org’s changelog confirms that Forminator 1.56.2, released July 30, 2026, fixed an arbitrary file-upload vulnerability.
CERT-In regularly publishes vulnerability notes and broader cyber-risk guidance for Indian users and organisations. For wider context on the threat environment, see ThePulseSignal’s CERT-In Cyber Threats 2026 analysis.
Why is Forminator 1.57.0 still vulnerable?
The newer issue is CVE-2026-66583, published on August 20, 2026.
The vulnerability affects Forminator versions up to and including 1.57.0 and is classified as an unauthenticated PHP Object Injection vulnerability.
The CVE data lists version 1.57.1 as unaffected.
That creates the main version-confusion problem for WordPress owners:
- 1.56.2 addressed the older arbitrary file-upload flaw.
- 1.57.0 is newer than 1.56.2, but it is still inside the affected range for CVE-2026-66583.
- 1.57.1 is the current WordPress.org release and is outside the CVE-2026-66583 affected range.
What is PHP Object Injection?
PHP Object Injection occurs when an application unsafely processes attacker-controlled serialized PHP data.
For CVE-2026-66583, the vulnerability can be triggered remotely without authentication or user interaction.
However, an important distinction is required: PHP Object Injection does not automatically mean every vulnerable WordPress site can immediately be taken over.
Higher-impact exploitation can depend on whether a usable PHP object or POP gadget chain is available through Forminator itself, another installed plugin, the active theme or another component in the site’s PHP environment.
If such a chain exists, object injection may potentially be escalated into effects such as code execution, SQL injection or path traversal. Without a suitable chain, the vulnerability can still create security impact, including denial-of-service conditions.
Does CVE-2026-66583 require a logged-in WordPress account?
No. The vulnerability is described as unauthenticated.
That means an attacker does not need a normal WordPress account before attempting to reach the vulnerable functionality.
This increases the importance of updating because public WordPress sites may expose Forminator functionality to internet traffic by design.
What version of Forminator should you update to?
The safest practical answer from the currently reviewed evidence is:
Update Forminator to version 1.57.1 or a later vendor-supported release.
WordPress.org currently lists Forminator 1.57.1 as the current version and reports more than 600,000 active installations.
The plugin changelog also shows that August 18 contained a rapid sequence of security releases:
- 1.57.0.1 — Cross-Site Scripting vulnerability fix
- 1.57.0.2 — Cross-Site Scripting vulnerability fix
- 1.57.0.3 — Cross-Site Scripting vulnerability fix
- 1.57.0.4 — Cross-Site Scripting vulnerability fix
- 1.57.0.5 — Hub-Connector security improvements
- 1.57.0.6 — PHP Object Injection vulnerability fix
- 1.57.0.7 — privilege-escalation vulnerability fix
- 1.57.0.8 — payment-processing security fix
- 1.57.1 — security fix affecting Multisite site registration
Because several security fixes were released in sequence, users should not deliberately stop at an intermediate 1.57.0.x maintenance build when the current supported release is available.
Is Forminator 1.56.2 safe?
Not against every currently known Forminator issue.
Version 1.56.2 fixed the arbitrary file-upload vulnerability identified in CERT-In’s CVE-2026-15748 warning.
But CVE-2026-66583 affects versions up to and including 1.57.0. That means 1.56.2 remains inside the affected range for the newer object-injection vulnerability.
So a site owner who upgraded only to 1.56.2 after reading the CERT-In advisory should check again and move to 1.57.1 or later.
Is Forminator 1.57.0 safe?
No, not according to the CVE-2026-66583 affected-version data.
Version 1.57.0 is explicitly included in the affected range.
If WordPress shows Forminator 1.57.0, the site administrator should treat the plugin as requiring a security update.
What if you are running Forminator 1.57.0.6?
The WordPress.org changelog says version 1.57.0.6 contains the PHP Object Injection fix.
However, later 1.57.0.x security builds and version 1.57.1 were subsequently released on the same date.
For that reason, the reader-facing recommendation is not to select one intermediate maintenance build. Update to the current vendor-supported release instead.
How to check your installed Forminator version
- Sign in to the WordPress administration dashboard.
- Open Plugins and locate Forminator.
- Check the installed version shown with the plugin entry.
- If it is 1.57.0 or older, check for the available update.
- Back up the site according to your normal maintenance procedure.
- Install the current Forminator update.
- Confirm the version after the update completes.
- Test important forms, registrations and payment workflows used by the site.
If the dashboard does not offer an update even though WordPress.org lists a newer release, site administrators should investigate the site’s plugin-update configuration or obtain the current release through the official WordPress.org distribution rather than downloading a copy from an untrusted source.
Should you disable Forminator if you cannot update immediately?
Installing the patched version is the preferred remediation.
If a site cannot update immediately, temporarily disabling or removing vulnerable functionality can reduce exposure, particularly on public-facing sites. A web application firewall or access restrictions may also reduce some attack opportunities.
These are temporary risk-reduction steps, not substitutes for applying the vendor update.
Do you need to disable every Forminator form after updating?
Not based on the evidence reviewed for this article.
If the plugin has been updated to a release outside the affected range and the site is operating normally, the advisories do not establish that administrators must permanently remove all forms.
Site owners should nevertheless test important forms after the upgrade because multiple Forminator security and maintenance releases were issued in a short period.
Was every vulnerable Forminator site compromised?
No.
A vulnerable version establishes exposure to a security flaw. It does not prove that an attacker successfully exploited a particular website.
ThePulseSignal did not find reliable evidence in the reviewed sources proving active in-the-wild exploitation of CVE-2026-66583 at the time of verification.
Site administrators should therefore avoid both extremes: do not assume a vulnerable site was definitely hacked, but do not leave the vulnerable version installed simply because no compromise is obvious.
What should sites previously running very old Forminator versions check?
Sites that remained on versions affected by the older arbitrary file-upload vulnerability have additional reason to review their environment after updating.
Useful checks can include:
- unexpected administrator accounts;
- unexplained files inside upload or plugin directories;
- recent plugin or theme changes that administrators did not make;
- unexpected scheduled tasks or server-side files;
- unusual redirects or injected content;
- security-plugin or hosting logs showing suspicious requests.
These checks are prudent post-exposure review steps. Finding that an old vulnerable version was installed does not itself establish compromise.
Why were there so many Forminator security releases on August 18?
WordPress.org’s changelog records several security-related maintenance versions released on August 18.
The fixes cover multiple vulnerability classes, including Cross-Site Scripting, PHP Object Injection, privilege escalation, payment-processing security and Multisite registration security.
This is another reason site owners should focus on reaching the latest supported version rather than trying to apply only the minimum version associated with a single CVE.
Does updating Forminator update WordPress itself?
No. Forminator is a WordPress plugin.
Updating Forminator changes the plugin version, not the WordPress core version. Site owners should separately maintain WordPress core, themes and other plugins because a secure Forminator release cannot protect against vulnerabilities elsewhere in the site stack.
Why are CVE-2026-15748 and CVE-2026-66583 easy to confuse?
Both are critical security issues affecting the same plugin and were highlighted close together, but their affected-version ranges are different.
The CERT-In advisory was issued on August 19 and says versions before 1.56.2 are affected by its arbitrary file-upload issue.
A newer CVE published August 20 says versions through 1.57.0 are affected by a PHP Object Injection issue.
Someone reading only the first advisory can therefore reach an outdated conclusion about the minimum version they should be running today.
What WordPress owners should do now
- Check the installed Forminator version.
- If it is 1.57.0 or older, update to 1.57.1 or a later vendor-supported release.
- Do not treat 1.56.2 as the current endpoint merely because CERT-In lists it as the fix boundary for CVE-2026-15748.
- Confirm that the update completed successfully.
- Test forms, registrations and payment workflows used by the site.
- If the site spent time on an affected older version, review logs and file changes for unexplained activity.
- Keep WordPress core, themes and other plugins updated because PHP gadget-chain risk can depend on the wider site environment.
What this vulnerability does not automatically mean
- It does not mean every Forminator website has been hacked.
- It does not mean every vulnerable site automatically allows remote code execution through CVE-2026-66583.
- It does not mean 1.56.2 is currently sufficient for all known Forminator vulnerabilities.
- It does not mean a site running 1.57.0 is outside the latest affected range.
- It does not mean disabling one public form fixes vulnerable plugin code permanently.
- It does not mean updating Forminator patches vulnerabilities in unrelated plugins or themes.
Related cybersecurity guidance from ThePulseSignal
- CERT-In Cyber Threats 2026: 5 Key Numbers Behind Finance & Healthcare Risk
- Apple Threat Notification in India: Is It Real, Is Your iPhone Hacked, and What to Do Next
Official and reviewed sources
- CERT-In Vulnerability Note CIVN-2026-0414 — Arbitrary Code Execution in Forminator Forms plugin of WordPress
- WordPress.org — Forminator current version and active-installation information
- WordPress.org — Forminator changelog showing August 18 security releases
- CVE record mirror — CVE-2026-66583 affected and unaffected Forminator versions
- IONIX — CVE-2026-66583 technical explanation and exploitation conditions
How this article was verified
ThePulseSignal reviewed CERT-In’s August 19 Forminator vulnerability note, WordPress.org’s current plugin version and changelog, and the CVE-2026-66583 affected-version information published on August 20.
The version boundaries were kept separate because CVE-2026-15748 and CVE-2026-66583 are different vulnerabilities. The article therefore does not treat the 1.56.2 fix boundary from the CERT-In advisory as the current safe endpoint for the newer object-injection issue.
ThePulseSignal also distinguishes PHP Object Injection from guaranteed remote code execution. Higher-impact exploitation of CVE-2026-66583 can depend on the existence of a usable PHP gadget chain in the site’s wider environment.
Last verified: August 21, 2026.
Limitations and unresolved points
- ThePulseSignal did not verify reliable evidence of active in-the-wild exploitation of CVE-2026-66583 at the time of review.
- A vulnerable plugin version does not prove that a specific WordPress site was compromised.
- The impact of PHP Object Injection can vary depending on the other plugins, themes and PHP classes available on the affected site.
- WordPress.org may publish a newer Forminator release after this article is published, so readers should prefer the latest vendor-supported security release rather than treating 1.57.1 as a permanent endpoint.
Frequently asked questions
Is Forminator 1.57.0 vulnerable?
Yes. CVE-2026-66583 lists Forminator versions up to and including 1.57.0 as affected by an unauthenticated PHP Object Injection vulnerability.
Is Forminator 1.56.2 safe?
Version 1.56.2 fixed the separate arbitrary file-upload vulnerability identified as CVE-2026-15748, but it remains inside the affected range for the newer CVE-2026-66583 issue. Update to 1.57.1 or a later supported release.
What version fixes the latest Forminator vulnerability?
The CVE-2026-66583 affected-version data marks 1.57.1 as unaffected. WordPress.org currently lists 1.57.1 as the current release.
Does the latest Forminator vulnerability require login access?
No. CVE-2026-66583 is described as unauthenticated, meaning a normal WordPress account is not required to attempt exploitation.
Can CVE-2026-66583 lead to remote code execution?
Potentially, but not automatically on every site. High-impact exploitation can depend on whether a usable PHP gadget or POP chain exists in the affected WordPress environment.
Did CERT-In warn about CVE-2026-66583?
The reviewed CERT-In Forminator note CIVN-2026-0414 addresses the separate CVE-2026-15748 arbitrary file-upload vulnerability. The newer CVE-2026-66583 has a different affected-version range.
How many sites use Forminator?
WordPress.org currently reports more than 600,000 active installations for the Forminator plugin.