CVE-2026-15748 Explained: How One Pipe Character Broke an "Exact Match" Blocklist
Item Detail CVE ID CVE-2026-15748 Affected product Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WordPress plugin) Affected versions 1.56.1 and earlier Fixed in 1.56.2 CVSS 3.1 9.8 (Critical) — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Type CWE-434 (Unrestricted Upload of File with Dangerous Type) Authentication required None Reported by daroo, via the Wordfence Bug Bounty Program Install base Installed on more than 600,000 WordPress sites Precondition The targeted form must co…