Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via Rendered Block Content
- ID
- WPSEC-2026-0998
- Plugin
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder (forminator)
- Affected
- from 1.54.0 before 1.58.2
- Remediation
- Update to 1.58.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder on WPSec AttackSurface
- Fix released
- Published
Description
The Forminator Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via rendered block content in versions 1.54.0 up to, and including, 1.58.1. This is due to the plugin's render_block filter (maybe_process_forminator_shortcodes) running do_shortcode() on the entire rendered output of any block except classic blocks, as soon as that output contains a Forminator shortcode. Some blocks show visitor-supplied text, such as the search query in a block theme's query title or search block, or comment text. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting a Forminator shortcode tag together with other shortcodes in such text.
References
- https://wpsec.com/vuln/WPSEC-2026-0998/
- https://plugins.svn.wordpress.org/forminator/tags/1.58.2/
- https://wordpress.org/plugins/forminator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS