🚨 Critical WordPress vulnerabilities! CVE-2026-15748 affects Forminator Forms and can allow unauthenticated arbitrary file uploads leading to RCE on vulnerable configurations. Versions ≤ 1.56.1 are affected; 1.56.2 is patched. CVE-2026-15826 affects User Profile Builder and enables unauthenticated authentication bypass via type confusion, potentially resulting in administrator takeover. Versions ≤ 3.16.4 are affected. Both carry CVSS 9.8 Critical. I've broken down the exploit chains, IoCs, detection queries, WAF rules, and hardening recommendations here: https://thecybersecguru.com/news/cve-2026-15748-forminator-rce-cve-2026-15826-user-profile-builder/ #WordPress #CVE #InfoSec #CyberSecurity #RCE #DFIR #BlueTeam