Forminator WordPress Plugin Flaw CVE-2026-15748 Allows Unauthenticated Code Execution

·8 views

A critical vulnerability, tracked as CVE-2026-15748, affects the Forminator Forms WordPress plugin in version 1.56.1 and earlier, and was fixed in 1.56.2. Reported through Wordfence's bug bounty program, it carries a CVSS score of 9.8 and requires no authentication to exploit. The plugin, installed on more than 600,000 WordPress sites, fails to properly restrict file uploads: it trusts upload settings supplied in the request rather than those saved by the admin, and its extension blocklist compares MIME types without normalization. Combined, these weaknesses let an attacker bypass the filter with a crafted value and upload a PHP file, enabling remote code execution. The exploit requires a targeted form containing both a file upload field and a select field.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Running LLMs On-Premise: Hidden Costs Beyond the Power Bill

A logistics firm's engineering director moved AI inference onto a local GPU after a cloud bill reached $8,000 in one month. Power consumption proved modest, but the true expense lies in setup and maintenance time that is rarely accounted for. By the author's estimate, the setup and debugging consumed about 40 hours over three months, covering driver conflicts, networking breakdowns, and silent output errors. Over three months, the local setup cost roughly $58 to $73 per month including hardware amortization, versus $180 to $240 for a comparable cloud API, with breakeven around month four. The analysis concludes that on-premise hosting pays off mainly for high-volume, repetitive, or privacy-sensitive workloads, while low-volume use is usually cheaper through an API.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Website Migration: Plan the Cutover Before Changing DNS

A successful website move requires transferring data, traffic, and business functions together, not just copying files to a new server. Teams should inventory every component, including the application, database, uploads, email, DNS, certificates, background jobs, and external integrations, and define who authorizes the switch and what would trigger a rollback. For live sites, a final synchronization or maintenance window is needed so that orders or registrations made after the initial copy are not lost, and two servers should never accept writes without a deliberate sync design. After cutover, the old server should stay available during the overlap period, with login, forms, checkout, redirects, background jobs, and email verified separately. The old service should only be retired once migration and retention requirements are met.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Offline Ethiopian Calendar App in Flutter

A developer describes building the Zemen App, an offline Flutter calendar that converts between Ethiopian and Gregorian dates and tracks national holidays and Orthodox fasting days. The core is a self-contained Dart engine that uses a Julian Day Number as a neutral pivot between the two calendars. The Ethiopian calendar's 13 months, with fixed month lengths and a leap year rule every four years, keep the conversion arithmetic simple. The engine relies only on integer math, so it behaves consistently across devices and is fast enough for calendar grids. The article walks readers through the algorithms so they can adapt the approach to other non-Gregorian calendars.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Developer Builds AI Tool to Validate Startup Ideas Using Live Data Sources

A developer spent three months creating Ainexa, a startup idea validator that scans live sources such as Reddit, Hacker News, and Product Hunt. Unlike general chatbots, the tool requires every claim to link to a verifiable source and avoids fabricating evidence. The creator analyzed the first 49 ideas submitted by early users and reported findings such as weak demand for thin AI wrapper products and that specific ideas tend to show stronger demand. He also noted that ideas with no competitors may signal a lack of market rather than an opportunity. He acknowledged that the product currently has no paying users, with distribution being his main challenge.

0 comments Read more at DEV Community