# Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via Rendered Block Content

- **ID:** WPSEC-2026-0998
- **Plugin:** Forminator Forms – Contact Form, Payment Form & Custom Form Builder (`forminator`), https://wordpress.org/plugins/forminator/
- **Affected versions:** from 1.54.0 before 1.58.2
- **Fixed in:** 1.58.2 (Update to 1.58.2 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/forminator
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0998/

## Description

The Forminator Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via rendered block content in versions 1.54.0 up to, and including, 1.58.1. This is due to the plugin's render_block filter (maybe_process_forminator_shortcodes) running do_shortcode() on the entire rendered output of any block except classic blocks, as soon as that output contains a Forminator shortcode. Some blocks show visitor-supplied text, such as the search query in a block theme's query title or search block, or comment text. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting a Forminator shortcode tag together with other shortcodes in such text.

## References

- https://wpsec.com/vuln/WPSEC-2026-0998/
- https://plugins.svn.wordpress.org/forminator/tags/1.58.2/
- https://wordpress.org/plugins/forminator/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0998/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.