Your Contact Form is An Open Door to Hackers. Here's the Fix.

Bob's contact form is the only thing on his website that makes him money.

The rest of it is a picture of a truck and a list of the towns he covers. The form is where a stranger with a busted water heater turns into a job on Thursday. He has thought about that form exactly once in six years, on the day somebody set it up.

Here is what he has never thought about. A form is not a box you type in. It is a piece of software with permission to write files onto his server, put rows in his database, and send mail with his name on it. He installed all of that the day he wanted a "contact us" page.

On August 17, 2026, one of the most popular form plugins on WordPress got rated 9.8 out of 10 for a hole that let a stranger upload a file straight onto the site. No login. No password. Just the form, doing what a form does.

Let me show you what actually happened, then let me show you how to check your own.

TL;DR (the short answer)

Yes, a WordPress contact form can be the way an attacker gets into your site. In August 2026 Forminator Forms, a plugin on more than 600,000 WordPress sites, was rated 9.8 out of 10 for a flaw that let an attacker with no account upload a file, including a PHP file, and take over the site. It is tracked as CVE-2026-15748. Every version up to and including 1.56.1 is affected, and it was fixed in 1.56.2 on July 31, 2026. It only fires on sites whose form has both a File Upload field and a Select field, and only where the upload folder is not protected. Four other form plugins took their own 2026 ratings, three of them also 9.8.

3 Things to Remember

The Form Isn't a Box. It's a Program With Keys.

Here is the part nobody explains when they hand you a website.

When a stranger fills in your form, something on your server has to catch what they typed and do things with it. Write it down. Put it in the database. Attach the photo of the leaking pipe they uploaded. Email it to you. Every one of those is a permission somebody handed to a piece of code written by a company you have never spoken to.

That code is doing all of that on a public page. Anybody on earth can reach it. That is the point of a contact form. It is also the problem.

The mistake: thinking of your contact form as part of your design.

The fix: find out which plugin runs it, and what version.

The payoff: you can answer the only question that matters in ten seconds instead of guessing.

I have said for years that the danger is the plugin pile you can't safely remove, and that Wordfence logs hundreds of WordPress holes in a single week. This one is different because of where it sits. It is not a slider nobody looks at. It is the page you send every ad click to.

600,000 Sites Ran This Form. It Scored a 9.8.

Forminator Forms is a WordPress form plugin with more than 600,000 active installs. On August 17, 2026, Wordfence published a report on a flaw in it, tracked as CVE-2026-15748, rated 9.8 out of 10. (Wordfence via The Hacker News, 2026)

Ten is the top of that scale. It landed at 9.8 for one reason: an attacker needed no account and no help from you.

In plain words, the plugin checked what kind of file you were uploading and did not check hard enough. An attacker could submit the form with a file that was not a photo of a leaking pipe. It was a PHP file, which is a file the server will run instead of just store. Once that file is on the server and the server runs it, the attacker is not a visitor anymore. They are inside.

Now the Honest Part, Because It Matters Here.

I am not going to make this scarier than it is. Two things have to be true before that hole fires, and you deserve both of them.

One. The form has to have both a File Upload field and a Select field on it. A plain name, email and message form does not have the combination.

Two. In the plugin's normal setup, uploads land in a folder that carries a protection file telling the server not to run anything in it. The real danger is on sites where somebody changed the upload location to a custom folder, because that protection file does not always get written there. (Wordfence via The Hacker News, 2026)

So this is not "600,000 sites got hacked." It is not close to that, and anybody telling you otherwise is selling something.

Here is why it still matters. Nobody reading this knows which of those two things is true on their own site. You did not pick the upload folder. Your web guy did, in 2021, and he is not answering. That is the actual problem, and it does not go away when the rating does.

It Wasn't Just One Form Plugin. It Was a Year of Them.

Forminator got the headline. It was not alone in 2026.

• Ninja Forms File Uploads. CVE-2026-0740, rated 9.8. Arbitrary file upload in all versions up to and including 3.3.26. Partly patched in 3.3.25 and fully patched in 3.3.27. (NVD, 2026)
• Kali Forms. CVE-2026-3584, rated 9.8. Remote code execution in all versions up to and including 2.4.9. (NVD, 2026)
• Everest Forms Pro. CVE-2026-3300, rated 9.8. PHP code injection in all versions up to and including 1.9.12, and only on forms using the Complex Calculation feature. (NVD, 2026)
• MW WP Form. CVE-2026-4347, rated 8.1. Arbitrary file moving in all versions up to and including 5.1.0, and only where a file upload field exists and inquiry data is saved to the database. (NVD, 2026)
• Avada Builder. CVE-2026-8713, rated critical, on a plugin used on one million sites. Arbitrary file deletion, fixed in 3.15.4, and only where a published Avada form saves submissions to the database. Deleting the wrong file can reset a site to its setup screen. (BleepingComputer, 2026)

Read that list again and look at what it has in common. Five different companies. Five different plugins. One year. Every one of them is the box your buyer types into.

I am giving you the rating and the affected versions on each and not an install count, because I could only confirm the install counts on two of them and I am not going to hand you a number I did not check.

Your Password Was Never Part of This.

Everything you have been told about website security is about the front door. Long password. Two-factor. Do not use admin as your username. All good advice, all worth doing.

None of it did anything here.

The word on these reports is unauthenticated. It means the attacker never had to log in to anything. They filled in a form on a public page, the same way a customer does.

You can do every single thing right and still be open, because the hole is not in the lock. It is in the thing you put on the page specifically so strangers could reach it.

The mistake: believing that a strong login protects the parts of your site that were built for the public.

The fix: ask who is responsible for updating your form plugin, and get the answer in writing.

The payoff: you stop finding out about your own website from somebody else.

You are a plain-talking website helper. Here is the list of plugins running on my WordPress site, with versions if I have them: [PASTE YOUR PLUGIN LIST].

Do this and show me a short table.
1) Tell me which of these plugins runs my contact forms.
2) For that plugin, tell me the newest version available today and whether my version is older.
3) Tell me if that plugin had a security problem reported in 2026, and if it did, say the rating out of 10 and the version that fixed it.
4) Tell me in plain words what my form is allowed to do on my server: can it save files, write to the database, and send email.
5) Give me the exact questions to ask whoever manages my site, and what a good answer sounds like.

Rules: short sentences, no jargon. If you cannot confirm something, say you cannot confirm it instead of guessing.

Check These Three Things on Your Own Form Today.

You do not need a security audit. You need ten minutes and a phone.

• Find the plugin. Dashboard, then Plugins. Look for the one with "form" in the name. Write down the name and the version number next to it.
• Look at your own form like an attacker would. Open your contact page. Is there a file upload button on it? A dropdown menu? If you have both, you are in the group that the Forminator hole applied to.
• Ask one question of whoever manages your site. "What date was my form plugin last updated?" If nobody can give you a date, that is your answer.

That is the whole checklist. If all three come back clean, go run your business.

A Form That Isn't a Plugin Can't Have a Plugin's Holes.

The reason my builds do not have this problem is boring. There is no third party form engine sitting on the page waiting for a stranger to feed it something.

A WordPress form plugin is built to do everything for everybody. File uploads, calculations, payment fields, conditional logic, twelve integrations. Most of that is code your site loads and never uses, and every piece of it is a place to make a mistake.

The forms I build do the two things your business actually needs. Take what the buyer typed. Get it to you fast. The pages are finished files on a fast network, and there is no general purpose upload handler sitting there to be tricked.

That is not me being clever. It is fewer moving parts. That is the whole idea behind the 100K Website, and it is why I say the old machine is done for real business sites.

And when a patch needs applying, that is my job. You go run your business.

Where the Form Plugin People Did Their Job.

I will give them full credit, and you should weigh it before you take my side.

Every single one of these got found, reported, and patched. Forminator shipped its fix on July 31, more than two weeks before the report went public, which is exactly the order you want. The researcher reported it instead of selling it. The plugin teams shipped. That whole chain worked.

And the Forminator hole needed a specific field combination and a changed upload folder before it could fire. Most sites running that plugin were never in the blast radius at all.

Now the turn. Every one of those fixes only counts if it landed on your site. The whole plan rests on you, or somebody you pay, installing an update inside a window you never see, forever, on a schedule set by five companies you have never spoken to. That worked in August. It has to work every month for the rest of your business.

Your contact form should be the most boring thing you own. Somebody types, you get an email, you call them back, you do the work.

It should not be a piece of software you have to track version numbers on between jobs.

Let me show you what a site with nothing on it to break into actually feels like, built on your own market.

Take a Test Drive →

You get a real look at your own market. No obligation, and nothing to cancel.

Want the whole playbook first? Plan your attack. Balls Out Marketing.

FAQ

This is post 3 in a run on WordPress security. Post 1 covered the July 2026 hole in WordPress core that needed no password. Post 2 covered the buyer who picked up 30 plugins and shipped a backdoor to all of them. Those two came in through the software. This one comes in through the page you built on purpose.